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PREFACE 

The  final  report  for  the  Brassboard  Fault  Tolerant  Spaceborne  Computer 
is  being  prepared  in  three  volumes.  Volume  1 contains  a description  of  the 
computer  architecture  and  the  methods  employed  in  achieving  fault  tolerance. 
Volume  2,  when  issued,  will  contain  a description  of  the  fault  recovery  process, 
and  an  overview  and  listing  of  key  BFTSC  documents.  Primarily  as  it  is  planned 
for  the  prototype  FTSC,  Volume  3,  when  issued,  will  contain  the  results  of  the 
post-brassboard  activity,  through  the  end  of  contract. 
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SECTION  ] 

INTRODUCTION 

The  Rrassboard  Fault-Tolerant  Spacehorne  Computer  (BFTSC)  is  the 
breadhoaril  of  a self-healing,  highly  reliable,  ,k;ene  ral-purposc  computer  designed 
to  have  a 95  percent  probability  of  surviving  a live-year  niission  in  a space  en- 
vironment without  any  degradation  in  performance.  The  BFTSC  is  the  result  of 
a 17-month  hardware  design  and  development  effort  by  Raytheon  Company  for  the 
United  States  Air  Force.  Space  and  Missile  Systems  Organization.  The  computer 
is  the  predecessor  of  the  flyable  prototvpe  Fault-Tolerant  Spaceborne  Computer 
(FTSC). 

The  BFTSC  is  a high- reliabil ity  general  purpose  micro-programmed  com- 
puter with  the  following  features: 

COMPUTATIONAL 

• 100,  000  operations/second  (>200,000  in  the  FTSC) 

• 05  instructions  (expandable  to  12S) 

• Integer,  floating  point,  and  \ ector  operations 

• Eight  general  purpose  registers 

• Four  working  registers 

• Four  special  purpose  registers 

• 32-bit  data 

• 61,440  words  of  addressable  memorv 

R ELIA  BUTTY 

• Demonstrates  fault-tolerant  concepts  necessarv  to  acliieve>95  percent 
probability  of  operating  for  five  years 

I/O 

• One  high-speed  redundant  DMA  chaiuiel  (two  in  the  FTSC) 

• Three  low-speed  redundant  user  channels  (vjp  to  o2  in  tlie  FTSC) 

The  conipviter  is  segregated  into  functional  elements  with  each  element 
protected  by  at  least  one  spare.  In  addition,  several  of  these  elenuMits, 
notably  the  memory  elenients  and  the  address  and  data  buses,  are  provided  with 
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redundancy  at  the  subelement  level  through  the  use  of  rippler  switches,  thereby 
significantly  reducing  the  redundant  hardware  that  would  otherwise  be  required. 
The  Configuration  Control  Unit  (the  ultimate  guardian  of  the  system  configuration) 
has  been  reduced  in  complexity  by  distributing  nmch  of  its  function  (and  hence  its 
unreliability)  to  other  computer  elements.  High  fault  coverage  is  assured  through 
the  extensive  use  of  coding,  and  single  point  failure  mechanisms  have  been  avoided 
by,  among  other  things,  providing  at  least  two  paths  for  all  critical  signals. 

For  the  purpose  of  clarity  of  this  document,  a Glossary  of  Terms  is 
provided  as  Appendix  B of  this  document. 
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SKCTION  2 

APPLICAIMJ-:  DOCUMKNTS 


CDIU.  Titlo 

A006  Subsystt  in  Dcsinii  Analysis  Report, 

RFTSC  Architecture 

A007  Confijiurat  ion  Item  Development  Specifica- 

tion, HFTSC  Architecture  Design 

AGIO  Configuration  Item  Product  Fabrication 

Specification,  RFTSC  I,ogic  Design 

AGll  Ci>mputer  Program  Development  Speci- 

fication, IIFTSC  Fxecut  ive/Recovery 
Software  Design 

A014  Technical  Data  for  FTSC  Prototype 

Specificat  ion 

A016  I'hcecut ive/Recovery  Software  User's 

Manual 


A017  Computer  Program  Product  Specification 

Fx e c u t i V e / R e c i> VC  r y S o f t w a r e 

A029 


A03() 


Prototype  Enhancement  Recommendations 
Oper.itions  aiul  Program  Manual 
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SECTION  3 

ARCIUTECTURAL  OVERVIEW 

The  Brassboard  Fault- Tolerant  Sp.iceborne  Computer  (BFTSC)  is  a general 
purpose,  stored  program,  32-bit,  parallel  computer  capable  of  executing  a reper- 
toire of  instructions  in  a variety  of  addressing  modes.  The  BFTSC  processing 
characteristics  are  specified  in  Table  3-1.  The  BFTSC  modules  and  their  inter- 
connection buses  are  as  shown  in  Figure  3-1.  Each  module  within  the  BFTSC 
contains  an  interface  connecting  it  to  the  internal  buses.  All  intermodule  commu- 
nication in  both  normal  and  reconfiguration  modes  takes  place  via  these  buses. 

3.  1 BUS  DESCRIPTION 

There  are  seven  internal  buses  in  the  BFTSC  (shown  in  Figure  3-1),  i.  e.  , 
Address  Bus,  Data  Bus,  Control  Bus,  Interrupt  Bus,  Status  Bus,  Timing  Bus, 
and  Power  Bus.  Each  of  these  buses  is  either  provided  with  switchable  spare 
lines  or  implemented  in  a triple-modular-redundant  (TMR)  configuration.  The 
function  of  each  of  these  buses  is  described  below: 

a.  Address  Bus 


Data  Bus 


c.  Control  Bus 


d.  Interrupt  Bus  - 

e.  Status  Bus 


f.  Timing  Bus 

g.  Power  Bus 


Contains  the  lines  which  convey  the  16  bits  compris- 
ing each  address  plus  the  eight  bits  comprising  its 
error  code. 

Contains  the  lines  which  convey  the  32  bits  cojiipris- 
ing  each  data  word  plus  the  eight  bits  comprising 
its  error  code. 

Contains  the  lines  which  control  bus  access  and  the 
lines  indicating  the  beginning,  end,  direction,  and 
type  of  transfer. 

Contains  the  lines  indicating  interrupts  from  each  of 
the  DMAs,  SlUs,  Timing  Modules,  and  CCUs. 

Contains  the  lines  indicating  out-of-tolerance  coiuli- 
tions  in  the  Timing  and  I^ower  Units,  tlie  lines  which 
indicate  detected  faults,  and  the  lines  wbicl)  convey 
configuration  status  information. 

Connects  the  system  clock  lines  and  the  Ha  rdeneil 
Timer  outputs  to  the  rest  of  the  system. 

Connects  the  system  voltages  from  the  Power  Modules 
to  the  rest  of  the  systi'm. 
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Table  3-1.  BFTSC  Characteristics 


Type: 

General  purpose,  stored  program,  parallel, 
digital  computer 

Arithmetic 

Binary,  two's  complement,  fixed-point  and  floating- 
point 

Data  Word 
Formats : 

32-bit  fixed-point  (integer) 

32-bit  floating-point  (24-bit  mantissa  and  8-bit 
radix-2  exponent) 

Instruction 

Word  Format: 

Single  32-bit  format 

Address  Modes: 

Register-Register 

Immediate 

Direct 

Indirect 

Indexed,  Postincrement 

Indexed,  Predecrement 

Indexed 

Indexed,  Indirect 

Architecture: 

Integrated  floating-point  and  fixed-point  (integer) 
processor;  microprogrammed  centralized  control 

Registers : 

Eight  general  purpose  registers  (32-bit)  that  serve 
as  accumulators,  index  registers,  or  address 
pointers 

Eight  working  and  special  purpose  registers  that 
include  dedicated  program  registers  as  well  as 
data  and  memory  address  registers 

Interrupts : 

Eight  normal  interrupts,  an  illegal  op  code  inter- 
rupt, and  a fault  interrupt 

Figure  3-1.  BFTSC  System  Block  Diagram 
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3.2  DESCRIPTION  OF  MODULE  FUNCTIONS 

Functional  descriptions  of  each  of  the  BFTSC  nnodules  are  contained  in  the 
following  paragraphs  and  are  summarized  in  Table  3-2. 

3.  2.  1 CENTRAL  PROCESSING  UNIT  (CPU) 

The  CPU  implements  all  arithmetic  and  logical  operations  required  to  pro- 
cess application  and  fault  recovery  programs.  There  are  four  CPU  Modules  in 
the  BFTSC,  two  of  which  are  powered  during  normal  operation.  One  of  the 
powered  CPUs  is  designated  as  the  active  module,  the  other  as  the  monitor. 

Each  CPU  has  the  following  features: 

• Executes  the  95  instructions  as  defined  in  Appendix  A.  These  instruc- 
tions are  performed  on  32-bit  data  words  and  include  integer,  floating 
point,  and  logical  operations. 

• Eight  addressing  modes: 

- Register-Register  - Indexed,  Postincrement 

- Immediate  - Indexed,  Predecrement 

- Direct  - Indexed 

- Indirect  - Indexed,  Indirect 

• Microprogrammed  using  a IK  x 80-bit  read-only  memory  (ROM). 

• Eight  program  addressable  32-bit  general  purpose  registers,  an 
extension  register,  a program  counter,  status  registers,  a memory 
address  register,  a memory  data  register,  and  four  working 
registers. 

• Capable  of  recognizing  and  processing  ten  levels  of  interrupts, 

• Incorporates  a bus  arbiter  to  resolve  bus  access  conflicts  among 
the  CPU,  SIU,  and  DMA. 

• Capable  of  operating  in  either  of  two  modes:  active  or  monitor. 

The  active  CPU  provides  all  information  and  control  to  the  system; 
the  monitor  CPU  compares  the  outputs  from  the  active  CPU  with 
those  it  would  have  generated  if  it  were  the  active  CPU  and  reports 
any  discrepancy  to  the  Configuration  Control  Unit  (CCU). 

• A IK  X 32-bit  reconfiguration  read-only  memory  (ROM)  which  con- 
tains the  reconfiguration  program.  This  program  is  initiated  in 
response  to  a fault  interrupt. 
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Tulilo  3-Z.  liFTSC  Functional  Units 


P'vjnct  ion 

Desc  r ipt  ion 

CPU  - Central  Processing  Unit 

The  CPU  implements  all  arithmetic  anti 
logical  operations  required  to  jiroccss 
IIFTSC  programs. 

MM  - Main  Memory 

The  MM  contains  all  active  DFTSC  pro- 
grams and  data. 

ecu  - Configuration  Control 

The  ecu  coordinates  hardware  configura- 

Unit 

tion  management  in  the  RP'TSC.  Upon 
detection  of  a fault  within  the  system,  it 
selects  a CI^U  and  bu;:  configuration  and 
initiates  the  recovery  [irogram.  The 
ecu  supplies  the  necessary  hardware 
status  information  to  the  recovery  pro- 
gram for  successful  iliagnosis  of  the 
fa  i hi  re. 

DMA  - Direct  Memory  Access 

The  DMA  allows  a peripheral  device  to 
transfer  data  directly  to  MM  at  rates 
of  up  to  5M  bits /second.  Data  transfers 
are  initiated  under  program  control,  but 
are  performed  independently  of  the  CPU. 

SIU  - Serial  Interface  Unit 

The  SIU  is  thi-  connection  with  the  serial 
data  bus  that  allows  up  to  bZ  low-speed 
peripheral  units  to  interface  to  the  RFTSC 
in  a direct  memory  access  moile. 

DIU  - Device  Interface  Unit 

The  DIUs  interface  peripheral  devices  to 
the  serial  data  bus  at  rates  of  up  to  325K 
bits/second.  Th»'  DIUs  are  installed 
within  the  peripheral  housing. 

TU  - Timing  Unit 

The  TU  provides  the  UFTSC  clock  and  the 
real-time  interrupt. 

PU  - Power  Unit 

The  PU  supplies  all  regulateil  power  re- 
quireil  to  operate  the  UFTSC. 

HT  - Hardened  Timer 

The  IIT  accumulates  elapsed  time  during 
recovery  periods  and  radiation  events  so 
that  programs  which  are  time  dependent 
can  be  restarted  without  degradation  after 
recovery  has  bi'en  I'ffected. 

CU  - Circumvention  Unit 

The  CU  monitors  radiation  levels  to  de- 
termine whi’ii  the  UFTSC  will  cease  to 
operate  coriu-ctly.  When  this  radiation 
level  occurs,  memory  and  I/O  clamps  are 
activated  to  protect  the  meniory  contents 
and  prevent  I/O  changes. 
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CONFIGUILATION  CONTROL  UNIT  (CCU) 

Tho  CCU  lias  fho  capability  to  interrupt  the  CI’U  whenever  a fault  is  de- 
tected and  to  provide  sufficient  status  information  to  ensure  a successful  recon- 
figuration following  any  non- catast rophic  fault.  There  are  three  CCU  Modules  in 
the  RFTSC  which  operate  in  a triple-modular-redundant  (TMR)  configuration. 

Each  CCU  performs  the  following  functions: 

• Causes  the  fault  recovery  program  to  be  initiated  by  issuing  a fault 
interrupt  to  the  CPU  whenever  a failure  is  detected  by  one  or  more 
of  the  fault  detection  monitors.  (The  fault  interrupt  is  not  issued  if 
the  specific  failure  detected  lias  been  previously  masked  under  pro- 
gram control.  ) 

• Changes  the  CPU,  address  bus,  and/or  data  bus  configurations  when- 
ever a failure  indicates  tliat  such  a change  is  necessary  to  effect  a 
successful  recovery. 

• Accepts  program  flag  inputs  from  the  CPU.  The  functions  performed 
by  these  inputs  include  masking  certain  types  of  faults  and  causing 
the  CPU,  address  bus,  or  data  bus  states  to  be  changed, 

3.2.3  MEMORY  MODULE  (MM) 

The  main  memory  in  the  BFTSC  is  con\posed  of  three  independent  Memory 
Modules  each  with  a capacity  of  4096  words.  The  design  permits  expansion  (in 
the  FTSC)  to  24  Memory  Modules,  IS  of  which  can  bt-  active,  directly  addressable 
memory  (61,440  words).  The  remaining  Memory  Modules  are  unpowered  spares. 
Each  Meniory  Module  has  the  following  features: 

• Provides  non-volatile,  non-destructive  readout,  random  access  stvirage 
for  BFTSC  programs  aiul  data. 

• A word  size  id  41  bits,  consisting  of  38  active  bits  and  three  spare  bits. 
The  38  active  hits  consist  of  32  bits  of  data  .ind  six  bits  of  code. 

• The  capability  to  select  the  active  and  spare  bit -line  positions  under 
program  control.  This  selection  applies  to  all  words  in  the  module 
so  that  if  a bit  is  identified  as  a spare,  that  bit  is  a spare  in  each 
word  of  the  niodule. 

• May  be  assigned  any  one  of  the  following  15  sets  of  contiguous  addresses: 
0 to  4K-1,  4K  to  8K-1,  ...  , 5t'K  to  bOK-l  (K  indicates  1024  words). 
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• Ability  to  individually  w rito-protoct  each  memory  subblock  under 
program  control.  (Each  Meniory  Module  is  divided  into  four  sub- 
blocks of  1024  contiguous  locations  each.  ) Any  attempt  to  store  into 
a write- protected  area  leaves  the  information  in  that  address  un- 
changed and  causes  a fault. 

• Capability  of  iletecting  multiple  bit  errors  using  the  b-bit  code  in 
each  word.  The  memory  can  also  correct  single  bit  errors  when 
put  in  the  error  correcting  mode  under  program  control. 

• Can  be  powered  on  or  off  under  program  control.  (Eollowing  power- 
on,  a Memory  Module  does  not  respond  to  read  or  write  operations 
until  so  ilirected  under  program  control.  ) 

3.2.4  SERIAL  DATA  BUS 

The  serial  ilata  bus  subsystem  allows  up  to  62  external  interfaces  to  the 
system.  Three  are  provided  in  the  L3FTSC:  they  connect  to  the  keyboard/CRT, 
the  paper  tape  reader,  and  the  status  panel.  The  serial  bus  is  controlled  by 
the  Serial  Interface  Unit  (SIU)  and  is  connected  to  the  peripherals  through  dual- 
redundant  Device  Interface  Units  (DIU).  It  is  a uni-directional,  daisy-chain 
system  with  dual- redundant  serial  links  between  each  contiguous  pair  of  DIUs 
along  tlie  bus. 

3.2.4.  1 Serial  Interface  Unit  (SIU) 

The  BFTSC  contains  two  SIU  Modules  connected  in  a dua  1- redundant  con- 
figuration. Orily  one  SIU  is  powered  at  a time:  it  can  be  powered  off  and  the 
other  powered  on  under  program  control  when  a failure  is  detected.  Each  SIU 
Module  has  the  following  capabilities: 

• Transfers  blocks  of  words  between  the  serial  bus  and  main  memory 
using  a dir ect-memorv-access  capability. 

• Is  able  to  sequentially  access  any  number  of  locations  in  a prograni 
specified  block  (module)  of  memory.  It  fetches  a word  from  each 
address,  transmits  the  word  over  the  serial  bus,  and  stores  the  re- 
turned (possibly  modified)  word  liack  into  the  memory  location 
from  which  it  was  fetched. 

• Synchronizes  the  initiation  of  a block  transfer  with  the  real-time 
interrupt  (RTI).  (In  the  Immediate  Mode  (cf.  Section  5.  3.4.  1),  the 
block  transfer  is  initiated  with  the  next  transmitted  word.  ) A new 
block  transfer  can  not  be  initiated  if  the  SIU  is  already  in  the  process 
of  transmitting  a block. 
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• Can  generate  two  levels  of  interrupts:  an  end-of-block  interrupt 
signalling  the  completion  of  the  current  block  transfer,  and  a high- 
priority  interrupt  indicating  peripheral  initiated  interrupts  or  a 
failure  condition. 

3.  2.  4.  2 Device  Interface  Unit  (DIU) 

Each  peripheral  in  the  BFTSC  is  connected  to  the  serial  bus  through  a dual- 
redundant  pair  of  DIU  Modules.  Both  DiUs  in  each  pair  are  powered  at  all  times 
by  the  peripheral  with  which  they  are  associated.  Each  DIU  has  the  following 
characteristics: 

• Transmits  or  receives  status  (command)  information  or  data  in  accord- 
ance with  the  op  code  field  of  only  those  received  words  containing  its 
unique  pin  programmed  address. 

• Following  a peripheral  initiated  interrupt,  the  module  modifies  the 
first  available  serial  bus  word  to  indicate  an  interrupt  to  the  SIU 
(unless  a higher  priority  interrupt  is  already  indicated  in  the  word). 

The  DIU  repeats  the  interrupt  every  third  real-time  interrupt  (RTI) 
until  it  is  acknolwedged. 

3.2.5  DIRECT  MEMORY  ACCESS  (DMA) 

The  DMA  provides  a high  speed  parallel  interface  to  the  BFTSC.  There  is 
one  dual- redundant  pair  of  DMA  modules  in  the  BFTSC  (two  pairs  in  the  FTSC) 
which  is  connected  to  the  floppy  disc.  Only  one  DMA  of  the  pair  is  powered  on 
at  a time;  the  other  acts  as  an  unpowered  spare  and  can  be  powered  on  or  off 
under  program  control  when  a failure  is  detected.  Each  DMA  module  is  capable 
of  the  following: 

• Transferring  blocks  of  information  directly  from  any  active  Memory 
Module  to  the  peripheral  or  from  the  peripheral  to  memory. 

• Transferring  blocks  initiated  under  program  control  without  CPU 
intervention. 

• Passing  on  commands  sent  by  the  CPU  to  control  the  peripheral. 

• Generating  two  levels  of  interrupts:  an  end-of-block  interrupt  signal- 
ling the  completion  of  the  current  block  transfer,  and  a high-priority 
interrupt  indicating  a peripheral-initiated  interrupt  or  a failure 
condition. 
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TIMING  UNIT  (TU) 

Tht'  Timing  Unit  >.onsists  ot  two  powt'rod  Timing  Modules  in  a dual- redun- 
dant eonfik’uration.  One  module  is  active,  uhile  the  other  serves  as  a standby 
spare,  fc'ach  Timing  Module  has  the  follow  ing  teatures: 

• When  active,  it  generates  a system  clock  at  a frecpiency  of  1.Z5  MH'i 
(,1.5  MHz  in  FTSC). 

• When  active,  it  generates  an  internal  real-time  interrupt  (RTI)  every 
8.  80t>-l  ms.  Capability  is  } rovided  to  decrease  this  period  by  a 
factor  of  Z or  to  Increase  it  by  a factor  of  Z or  4.  (All  the  times  are 
divided  by  Z in  the  FTSC.  ) 

• When  active,  it  generates  an  external  real-time  clock  at  a frequency 
of31Z.5kHz. 

• I'rovides  dual  status  signals  to  other  BFTSC  modules  to  imlicatc 
its  active/standby  state. 

• Dual  monitors  to  check  its  system  clock  and  internal  real-time 
interrupt  outputs.  If  an  init-of-tolerance  condition  is  detected,  the 
detecting  Timing  Module  enters  the  standby  state  and  the  other 
Timing  Modvile  takes  over  the  active  role. 

3,Z.7  row FR  UNIT  (PU) 

The  I’ower  Unit  consists  of  two  Power  Modules  connected  in  a dual- 
redundant  configuration.  One  module  is  active  while  the  other  serves  as  a 
powered  st.^ndby  spare.  In  the  BFTSC,  one  coiimte rcial  supply  for  each  internal 
voltage  supplies  both  Power  Modules.  (In  the  FTSC,  each  Power  Module  shall 
convert  the  primary  power  input  to  the  internal  levels  required.  ) Each  Power 
Module  has  the  following  capabilities: 

• When  active  it  provides  the  internal  voltages  required  by  the  BFTSC. 

• Provides  dual  status  signals  to  the  other  BFTSC  modules  to  indicate 
its  active/standby  state. 

• Contains  dual  monitors  to  examine  its  output  voltage  levels.  If  an 
out-of-tolerance  condition  is  detected,  the  iletecting  Power  Module 
enters  the  standby  state  and  the  other  Power  Module  takes  over  the 
active  role. 
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3.2.8  CIRCUMVENTION  UNIT  (CU) 

The  Circumvention  Unit  is  desinneti  to  protect  the  BFTSC  during  radiation 
events,  power  interruptions,  and  timing  interruptions  by  clamping  all  Memory, 
DMA,  and  SIU  Modules.  There  are  three  Circumvention  Modules  in  the  BFTSC 
operating  in  a triple-modular- redundant  (TMR)  configuration.  Each  Circumven- 
tion Module  has  the  following  characteristics: 

• Accepts  inputs  from  distributed  radiation  detectors.  These  inputs 
can  be  connected  to  a simulated  radiation  source  in  the  BFTSC. 

• Monitors  the  status  signals  indicating  out-of-tolcrance  power  or 
timing  conditions. 

• During  the  period  following  detection  of  radiation,  power,  or  timing 
out-of-tolerance  conditions,  generates  grounded  clamp  signals  which 
prevent  memory  contents  from  being  changed  and  inhibit  all  I/O. 

3.2.9  HARDENED  TIMER  (HT) 

The  Hardened  Timer  keeps  track  of  real  time  during  radiation  events,  power 
module  failures,  timing  module  failures,  and  reconfiguration  after  a fault. 

There  are  three  Hardened  Timer  Modules  in  the  BFTSC  operating  in  a triple- 
modular-redundant  (TMR)  configuration.  Each  Hardened  Timer  Module  is  cap- 
able of  the  following: 

• Being  activated  upon  the  occurrence  of  a radiation  event,  a power 
failure,  a timing  failure,  or  the  detection  of  any  unmasked  fault 
by  the  CCU.  (It  receives  power  from  the  energy  storage  unit  so 
that  it  can  operate  during  a power  failure.  ) 

• Accumulating  the  number  of  real-time  interrupts  (RTI)  which  occur 
during  the  time  in  which  the  timer  is  active  by  charging  a capacitor 
from  an  internal  linear  current  source. 

• Stopping  accumulation  of  time  under  program  control. 

• Reading  and  resetting  the  accumulated  time  contents  under  program 
control. 

• Accumulating  up  to  6 seconds  of  elapsed  time. 
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SECTION  4 

REDUNDANCY  TECHNIQUES 

Three  redundancy  techniques  arc  employed  within  the  BFTSC:  triple- 
modular  redundancy,  spare  module  redundancy,  and  subelement  redundancy. 

The  BFTSC  is  partitioned  such  that  each  functional  element  utilizes  one  or  more 
of  these  techniques  to  obtain  the  required  reliability  for  that  element  with  a 
minimum  of  redundant  hardware, 

4.  1 TRIPLE- MODULAR  REDUNDANCY  (TMR) 

An  element  which  is  implemented  in  a triple-modular- redundant  (TMR) 
configuration  consists  of  three  identical,  independent  elements  simultaneously 
performing  the  same  function.  The  outputs  from  these  three  elements  are  sub- 
jected to  a majority  vote  wherever  they  are  used.  As  a result,  the  failure  of  a 
single  element  is  effectively  masked.  In  the  BFTSC,  triple-modular  redundancy 
is  used  for  the  Configuration  Control  Unit  (CCU),  the  Circumvention  Unit  (CU), 
the  Hardened  Timer  (HT),  and  some  of  the  Control  Bus  signals  (cf.  Section  5.  1.3). 

4.  2 SPARE  MODULE  REDUNDANCY 

Several  elements  within  the  BFTSC  have  redundancy  at  the  module  level; 
an  entire  module  can  be  directly  replaced  by  a spare.  This  type  of  redundancy  is 
used  in  the  Direct  Memory  Access  Units  (DMA),  Serial  Interface  Unit  (SIU), 

Device  Interface  Units  (DIU),  Power  Unit  (PU),  Timing  Unit  (TU),  Central  Pro- 
cessing Unit  (CPU),  and  Memory  Module  (MM). 

Each  DMA  and  SIU  consists  of  a dual- redundant  pair  of  DMA  or  SIU 
Modules.  Only  one  module  of  each  pair  is  active  with  the  other  serving  as  an 
unpowered  spare.  When  a failure  is  detected  in  the  active  module,  it  is  powered 
off  and  its  spare  is  powered  on  under  program  control.  Each  DMA  Module  within 
the  pair  has  its  own  external  interface  so  that  redundancy  can  be  extended  through 
to  the  user.  Each  SIU  Module  transmits  on  a different  serial  bus  line. 

The  DIUs  each  consist  of  a dual- redundant  pair  of  DIU  Modules,  both  of 
which  are  powered  at  all  times.  Each  DIU  Module  can  receive  from  either  of 
the  serial  bus  lines  from  the  previous  pair  on  the  bus,  but  it  transmits  on  only 
one  line. 
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An  operational  serial  bus  configuration  is  ensured,  by  the  self-switching  serial 
bus  monitors  within  the  following  DILI  Modules  (cf.  Sections  6.  9 and  6.  10),  for 
any  failure  within  a DIU  Module  or  the  serial  bus  line  on  which  it  transmits.  Each 
DIU  Module,  within  a pair,  has  its  own  external  interface  allowing  the  redundancy 
to  be  extended  to  the  user. 

The  Power  Unit  and  Timing  Unit  both  consist  of  dual- redundant  pairs  of 
Power  or  Timing  Modules.  One  of  the  modules  in  each  pair  is  active  and  the 
other  serves  as  a standby  spare.  When  a failure  occurs  in  the  active  module,  the 
dual-monitors  in  each  module  (cf.  Section  6.22  and  6.23)  automatically  switch  the 
spare  to  the  active  state. 

There  are  four  CPU  Modules  in  the  BFTSC,  any  two  of  which  can  be 
powered  at  a time.  One  of  the  two  powered  CPUs  is  active  while  the  other 
serves  as  a monitor  (cf.  Section  5.  3.  1).  When  a failure  occurs  in  one  of  the 
powered  CPU  Modules,  a different  combination  of  CPU  Modules  is  powered  on. 
Pairs  of  CPU  Modules  are  tested  in  a predetermined  cyclic  sequence  until  an 
operational  pair  is  found.  As  long  as  at  least  two  CPU  Modules  are  functional, 
an  operational  CPU  configuration  will  be  found. 

The  Main  Memory  is  divided  into  Memory  Modules  each  containing  4096 
(4K)  words  of  data  storage.  Up  to  24  Memory  Modules  can  be  accommodated  by 
the  BFTSC,  15  of  which  can  be  active.  The  remaining  Memory  Modules  serve  as 
unpowered  spares.  Each  active  Memory  Module  is  assigned  a "soft  name", 
under  program  control,  which  determines  the  4K  block  of  addresses  to  which 
that  Memory  Module  responds.  When  one  of  the  active  Memory  Modules  fails, 
a spare  is  powered  on  and  assigned  the  same  soft  name  under  program  control 
while  the  failed  module  is  turned  off. 

4.3  SUBELEMENT  REDUNDANCY 

Several  elements  within  the  BFTSC  are  designed  to  take  advantage  of  the 
generally  unappreciated  fact  that  the  amount  of  improvement  to  be  gained  in  the 
reliability  of  any  element  from  a given  expenditure  in  hardware  is,  at  least  up 
to  a point,  an  increasing  function  of  the  number  of  identical  subelements  into 
which  it  can  be  segregated. 
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Figure  4-1  illustrates  this  conceiJt.  Figure  4-l(a)  symbolically  represents 
an  element  having  a mean  time  before  failure  (MTBF)  of  one  year.  The  pro- 
bability that  such  an  element  operates  without  failure  for  a period  of  one  year 
is,  under  the  usual  constant  failure  rate  assumption,  only  0.  37.  If  the  same 
element  is  provided  with  a standby  spare  (Figure  4- 1(b))  which  can  substitue  for 
it  should  the  original  element  fail,  and  assuming  the  switch  itself  does  not  fail, 
one  can  easily  verify  that  this  100  percent  hardware  increase  results  ii.  a 50 

percent  increase  in  MTBF  and  a 62  percent  increase  in  P . On  the  other  hand. 

s 

if  the  original  element  could  be  segmented  into  four  identical  subelements,  and 
a single  spare  were  provided  which  could  be  substituted  for  any  one  of  these  sub- 
elements (Figure  4- 1(c)),  the  resulting  25  percent  increase  in  hardware  would 
increase  the  MTBF  by  80  percent  over  that  of  the  original  non- redundant  element 
and  would  increase  P^  by  86  percent.  Thus,  a 25  percent  hardware  increase  at 
the  subelement  level  is  theoretically  more  effective  than  a 100  percent  increase 
at  the  element  level.  Or,  if  a 100  percent  hardware  increase  were  applied  at 
the  subelement  level,  as  shown  in  Figure  4- 1(d)  with  any  one  of  the  spare  sub- 
elements able  to  assume  the  role  of  any  one  of  the  original  subelements,  the 
increase  in  the  MTBF  and  in  P^  would  be  254  percent  and  166  percent,  respec- 
tively, a major  improvement  over  that  afforded  by  applying  the  same  percentage 
hardware  increase  at  the  element  level. 

The  conclusions  to  be  drawn  from  this  example,  however,  are  subject  to  one 
very  important  qualification:  the  switch  inevitably  needed  to  accomplish  the  de- 
sired substitutions  will  itself  be  subject  to  failure.  Since  the  reliability  of  the 
switch  must,  in  fact,  decrease  as  the  number  of  subelements  to  be  switched  in- 
creases, the  point  must  be  reached  (were  it  possible  to  subdivide  the  element  in- 
definitely) at  which  the  switch  itself  becomes  the  dominant  source  of  failure.  Ob- 
viously, it  would  not  be  profitable  to  subdivide  the  element  further  once  this  point 
is  reached,  even  if  it  were  physically  possible  to  do  so. 

One  of  the  major  obstacles  in  realizing  the  potential  of  the  subelement  re- 
dundancy technique  is  the  need  for  a switch  that  can  configure  the  various  sub- 
elements into  an  operational  system  without  simultaneously  dissipating  much  of 
the  promised  gain  in  reliability.  A switching  device,  called  a "rippler  switch" 
was  designed  to  overcome  this  obstacle.  Basically,  the  rippler  functions  by 
replacing  any  defective  subelement  in  a linear  array  of  identical  devices  by  its 
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nearfst  neighbor  (in  some  specil'i«’tl  orUtM-in(> ),  then  replacin(i  that  ilevice  hy  its 
nearest  nei>>hbor,  etc.,  the  whole  process  "rippling"  down  the  array  of  suh- 
elen\ents  until  the  last  active  device  is  replacetl  by  the  first  available  spare. 

The  a<lvantane  of  this  switching  method  over  the  more  conventional  direct  sub- 
stitution approach  is  in  its  aiiienabil if y to  rel.dively  simpl<‘  (aiid  lienee  reliably 
implemented)  control  alj;orithnis. 

Figure  4-2  demonstrates  how  the  rippler  accomplishes  the  desired  switch- 
ing ft>r  an  element  whicli  is  partitioned  into  live  iilentical  subelements  with  three 
spar»'  subelements.  Fach  subelenu-nt  has  associateii  with  it  a rippler  slice  which 
can  assume  any  one  of  five  states.  The  rippler  states  estalilish  the  data  paths 
(indicated  by  the  lines  in  Figure  4-2)  which  provide  the  link  between  the  operating 
subelements  and  a set  of  input /output  ports  (represented  by  the  numbers  1 through 
5)  thereby  defining  the  functional  roh'  of  each  subelenu  nt.  If  fli»‘  rippler  slice 
associated  with  subelement  i is  in  state  the  subelemeut  i is  connecteti  to 

function  i,  if  in  state  Kj,  then  subelement  i is  connected  to  function  i-1.  Similarly, 
in  states  R,  and  R^,  subtdement  i is  connect etl  to  lunctions  i-2  and  i-1,  respect- 
ively. Finally,  in  state  R^,  subelement  i is  not  coniu-cttul  to  any  function.  In- 
itially, each  rippler  slice  ts  in  state  R^^  and  the  data  paths  are  as  shown  in 
Figurt'  4-2(a). 

Now,  suppose  subelement  fails.  The  fovirth  rippler  slice  is  set  to  R^,^ 
anil  all  subsequent  rippler  slices  are  ailv.inced  one  state  to  Rj.  As  shown  in  Fig- 
ure 4-2(b),  the  defective  subelemenl  is  ripfileil  out  and  the  first  spare  subelement 
is  useil.  Similarly,  Figure  4-2(c)  shows  the  n-sponsi'  to  a second  failure,  this 
one  in  subelement  S^.  The  second  rippler  slice  is  set  to  state  R^,^,  the  third  rippler 
slice  advances  one  state  to  Rj,  the  fourtli  slice  remains  in  state  R^^,  4ind  the  sub- 
sequent slices  are  ailvanced  one  state  to  R^*  '*  result  both  laili'il  subeleir.ents 

are  rippled  out  and  the  first  two  spare  subelements  are  rippled  in.  It  is  readily 
seen  that  this  control  algorithm  will  always  result  in  an  operational  systeiii,  re- 
gardless of  the  order  in  which  the  failures  occur,  so  long  as  the  number  ot 
failures  does  not  exceed  the  number  of  .ivailable  spares. 

In  the  BFTSC,  subelemeut  redundanev  is  employi'd  tor  the  addri'ss  .mil  data 
buses  and  for  the  memory  bit  lini'S  in  each  memory  module.  The  aildress  bus 
(cf.  Section  5.  1.  1)  is  partitioneil  into  three  S-bit  bytes  with  i>ne  spare  byte,  and 
the  d.ila  bus  (cf.  Section  5.1.2)  is  partitioned  info  five  8-liit  bytes  with  one  spare 
byte.  Fach  memory  module  (cf.  Si'ction  ■>.  F ’)  is  partitioneil  into  FS  bit  lini's 
with  1 spare  liit  lines. 
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I'hf  ra  s « l)i)a  rd  fault  - I'olt' ra  iit  Sp.n  t-liDiiif  t'oiupulfr  (HflSt’)  ir.  a lii_k;li 
r f I ia  l)i  U t y . gfUfX'al  iiurpust*,  uiii  roprv>i;raiiinuui.  iiuiiputfi'  witli  tlu- 

p ri>k' f s s t ug  i' ha  r ak' t u r i s t u’ s lislfd  ii\  lahlu  t-1.  I'lu'  iiu>dulk‘s  and  Ihk" 

Imsfs  whik'h  iutt^  rk  kuuu'kt  tht'Ui  aru  shk>\\'n  in  figure  t-1.  t'^ikh  imulule  kkithin 
the  Hfl'SC;  k'Dutain.s  an  intertak'e  kiuineit  ing  it  ti>  the  internal  buses.  All  inter- 
Mikulule  k'unmuinik'at  ikin  in  lu>th  iiDriual  anil  reki>nt  igu  ra  t ion  modes  takes  plaee 
via  these  buses. 

S.  1 INTf RNAl.  BUSES 

The  se\en  internal  buses  within  the  Hf  i'.SC'  ha\i‘  been  kontigured  to  pro- 
vide a suttieient  level  at  redundaney  tkJ  meet  the  reliabiUtv  reipii  rement  s ot  the 
k'kimputer.  faeh  k>t  the  buses  and  its  kkuit  igu  rat  ikni  is  listed  in  I'.ible  s-1. 


'I'able  S-1.  Internal  Buses 


.■\ildress 


Control 


Signals 


.-\ddress  Bits 


Bata  Bits 


Bus  .^cces^ 
Request 


Bvi  8 .A  e e e s 8 
.Aeknkiwli'dge 


Data  Reijuest 


C'ontigurat  ion 


b'kkiir  iS-bit  bytes:  twk)  b\tes  ot 
ailklress,  lUie  byte  ot  k'kide,  aiikl  kUie 
sjxi  re  byte,  Buseil  aiiuing  all  t’l’U, 
Memory,  DMA,  and  ,SIU  Modules. 

Six  S-bit  bytes:  tour  bytes  k>l  dat.i, 
I'ue  byte  ot  ii'ile,  and  lUU'  spare  byte 
Buseil  among  all  Memory. 

DMA.  and  SlU  Modules, 

One  line  from  e.-ioli  DM.A  and  RIU 
Module  to  all  fiuir  CPU  Modult's. 

(ef.  Figure  ‘',1) 

One  line  from  all  four  ('PP  ModuU-s 
tk^  eaeh  DM.A  ami  SB'  Mk'kiule, 

(ef,  figure  S,  1) 

TMR:  I'hree  lines  in  a triple- 

modula  r-  redundant  k ontiguration, 
generated  in  triplik-ate,  voted  at 
receiver,  Buseil  among  all  CPU, 
Memory,  DM.A,  and  SlU  Modules. 
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Table  5-1.  Internal  Buses  (Continued) 


Bus 

Signals 

Configuration 

Data  Acknowledge 

TMR:  Generated  in  triplicate,  voted 
at  receiver.  Bused  among  all  CPU, 
Memory,  DMA,  and  SlU  Modules. 

Read/ W rite 

TMR:  Generated  in  triplicate,  voted 
at  receiver.  Bused  among  all  CPU, 
Memory,  DMA,  and  SIU  Modules, 

Hard/Soft 

TMR:  Generated  in  triplicate,  voted 
at  receiver.  Bused  among  all  CPU, 
Memory,  DMA,  and  SIU  Modules. 

Interrupt 

Fault  Interrupt 

TMR:  One  line  from  each  CCU  Module, 
voted  at  receiver.  Bused  among  all 
CPU  Modules. 

I/O  Module 

Two  interrupts  from  eacli  DMA  and 

Interrupts 

SIU  Module.  Bused  among  all  CPU 
Modules, 

Real-Time  Interrupt 

One  line  from  eacii  Timing  Module; 
bused  in  a loop  to  all  CPU  and  SIU 
Modules  and  then  returned  to  the 

Timing  Module. 

Status 

Power  Status 

Two  lines  from  each  Power  Module; 
bused  in  a loop  to  all  applicable 
modules  and  then  returneil  to  the 

Power  Module. 

Timing  Status 

Two  lines  from  each  Timing  Module, 
bused  in  a loop  to  all  applicable 
modules  and  then  returned  to  the 

Timing  Module. 

Clamps 

1 

TMR;  Each  Circumvention  Module 
generates  three  clamp  signals  (CCU 
clamp,  I/O  clamp,  and  Memory 
clamp);  each  clamp  is  voted  at  its  re- 
ceiver. The  CCU  clanip  is  bused 
among  all  CCU  Modules;  the  I/O  clamp 
is  bused  among  all  Memory,  DMA, 

SIU  and  HT  Modules;  and  the  Meniory 
clamp  is  bused  among  all  Memory 
Modviles. 
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Internal  I'nses  (C'i)nt  inneii) 


C\)nti_i;n  rat  Lon 


I'liree  litu-s  j;em‘ rated  hy  i-aeh  CPU. 
Unseil  anti'H);  .ill  CCU  Modules. 

I'MK:  U.u'h  I't  the  three  sitinals 
(.ih'\ie,  reivmtlgur.ition  imuie,  ami 
r eiv>nt  i r.it  ion  nu>dt-  with  tla^  1 
not  set)  IS  k;eiu‘r.ited  in  t-.u'h  CCU 
MoiUlle  .uul  \ oted  .it  its  rev'eivi'r. 
I'nseil  .imoni;  .ill  .ippliiMhle  tnoiinles. 

I'hia'e  lines  (gener.ited  in  t r ij)l ieatt-) 
tor  e.uh  t.inlt  indiv'.ition  type  Imsml 
aiinnii;  all  siniri'es  ot  the  t.inlt.  One 
line  jjoe.s  to  eaeh  CCU  Module. 

Three  lines  (i^eiu- r.itml  in  triplieate) 
ti'r  e.u'h  I't  the  tollowinn  nioihile 
type  s:  CPU.  PM.-M,  l)Kt.\2.  and  .SlU. 
Ihise'd  .itin'm;  .ill  nioilnles  i>t  th.it  type. 
t.'>m"  line'  i;i't".‘'  to  e.u  h CXIU  Miidvile. 

'TMH:  Four  lim-s  t rom  eaeh  CCU 
Mi'diile,  vvited  at  reeeiver.  Bused 
anuini;  all  CPU  MiHinles. 

'TMR:  'Twe'  line's  trom  e'aeh  CCU 
Miuhlle',  veite'd  at  r e'e' e'ive' r.  BviSe'd 
anuMig  ell)  CPU,  Me'iuory,  DMA,  and 
SlU  Modules. 

M'MK:  'Three'  line's  treuu  e-aeh  CCU 
Menlule',  N'e'te'll  at  r e'e' e' iv  e' f . BuSt'll 
anie'ng  all  CPU,  Me-nuiry,  nM.-\,  and 
SlU  Moilllle'S. 


'TMR:  Fle'Ve'n  line-s  tremi  e'.ieh  CCU 
Meulllle',  Ve'te'il  at  r e'e' e' i V e' f . BuSe'll 
aiUeMli;  .ill  CPU  Menlule'S. 

l-hle'  line'  tre'Hl  e'.le'll  Tuning  Meulule'; 
IniSe'li  in  .1  le'e'p  tei  .ill  .1  pp  1 1 e .1  hie' 
llunlnle'S  .inel  the-n  re-turne-el  tee  the' 
Tliuini;  Me'elnle'. 
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Table  5-1.  Internal  Buses  (Continued) 


Bus 

Signals 

Configuration 

Hardened  Timer 
Output 

TMR:  One  line  from  each  Hardened 
Timer  Module,  voted  in  software. 
Bused  among  all  CPU  Modules. 

Hardened  Timer 
Reset 

TMR:  Generated  in  triplicate  by 
active  CPU,  voted  at  receiver. 

Bused  among  all  CPU  and  Hardened 
Timer  Modules. 

Power 

System  Voltages 

One  line  for  each  voltage  from  each 
Power  Module;  bused  in  a loop  to  all 
applicable  modules  and  then  returned 
to  the  Power  Module. 

Energy  Storage 

Two  lines  from  each  Power  Module; 
bused  among  all  Timing,  Hardened 
Timer,  and  Circumvention  Modules. 

5.1.1  ADDRESS  BUS 

Each  16-bit  address  is  encoded  by  appending  to  it  the  eight  parity  bits 
determined  by  a shortened  cyclic  code  structure.  The  cyclic  code  used  is  that 

s z 

defined  by  the  generator  polynomial,  g(x)  = {x°  + x + 1)  (x  + x + 1). 

The  address  bus  consists  of  four  electrically  isolated  8-bit  bytes.  Two  of 
these  bytes  are  used  to  convey  the  16  bits  comprising  each  address,  a third  byte 
is  used  for  the  parity  bits  associated  with  each  address,  and  the  fourth  byte 
serves  as  a spare  should  any  of  the  other  bytes  fail.  The  selection  of  the  appro- 
priate set  of  three  bytes  to  be  used  is  accomplished  by  a byte  rippler  at  each 
address  bus  interface.  The  byte  rippler  is  controlled  by  voted  status  signals 
from  the  CCUs. 

5.1.2  DATA  BUS 

Each  32-bit  data  word  is  encoded  by  appending  to  it  the  eight  parity  bits 

determined  by  a shortened  cyclic  code  structure.  The  cyclic  code  used  is  that 

6 Z 

defined  by  the  generator  polynomial,  g(x)  = (x  + x + 1)  (x  + x + 1). 


r: 
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The  data  bus  consists  ot  six  electrically  isolated  8-bit  bytes.  Four  of 
these  bytes  are  used  to  convey  the  32  bits  comprising  each  data  word,  a fifth 
b^te  is  used  for  the  parity  bits  associated  with  each  word,  and  the  sixth  byte 
serves  as  a spare  should  any  of  the  other  bytes  fail.  The  selection  of  the  appro- 
priate set  of  five  bytes  to  be  used  is  accomplished  by  a byte  rippler  at  each  data 
bus  interface.  The  byte  ripplers  are  controlled  by  voted  status  signals  from  the 
CCUs. 

5.1.3  CONTROL  BUS 

The  bus  access  request  and  acknowledge  lines  are  configured  as  show'n 
in  Figure  5- 1(a)  and  5- 1(b).  Each  of  the  I/O  modules  has  a dedicated  bus  access 
request  line  to,  and  bus  access  acknowledge  line  from,  the  CPU  ensemble.  The 
bus  access  request  and  acknowledge  lines  associated  with  one  I/O  module  of  a 
redundant  pair  are  electrically  isolated  in  the  CPUs  from  those  associated  with 
the  other  module  of  the  redundant  pair. 

Any  I/O  module  requiring  address  and  data  bus  access  in  order  to  initiate 
a data  transfer  to  or  from  a Memory  Module  raises  its  bus  access  request  line 
but  does  not  attempt  to  effect  the  data  transfer  until  its  bus  access  acknowledge 
line  is  raised.  The  bus  access  request  line  is  lowered  when  the  bus  access 
acknowledge  is  received.  The  completion  of  the  transfer  causes  the  bus  access 
acknowledge  line  to  be  lowered. 

The  configuration  of  the  data  request,  acknowledge,  read/write,  and 
hard/soft  lines  is  as  shown  in  Figure  5-2.  There  are  three  lines  for  each  of 
these  signals;  they  are  connected  in  a triple-modular-redundant  (TMR)  configura- 
tion. Each  of  the  three  lines  is  electrically  isolated  from  the  other  two  in  all 
modules  to  which  they  are  connected. 

The  module  controlling  the  data  transfer  (the  retpiesfing  module),  once 
it  has  access  to  the  buses,  sets  the  read/write  line  to  indicate  the  direction  of 
the  transfer,  places  the  address  of  the  location  to  be  accessed  on  the  address 
bus,  places  the  data  to  be  transferred  (if  a write  is  being  performed)  on  the 
data  bus  and  raises  the  request  line  to  initiate  the  transfer. 


DMA 

2B 


Figu  re  5-2.  Data  Request/ Acknowledge,  Read/Write 
and  Hard/Soft  Control  Lines 


When  information  is  to  be  transmitted  from  the  requesting  module  to  the 
addressed  niodule  (the  read/write  line  is  set  to  the  write  state),  the  addressed 
module  raises  the  acknowledge  line  only'  after  it  has  decoded  its  address  and 
verified  that  the  address  and  data  are  properly  encoded.  When  inforniation  is 
to  be  transmitted  from  the  addressed  module  to  the  requesting  module  (the 
read/write  line  is  set  to  the  read  state),  the  addressed  module  raises  the  ac- 
knowledge line  only  after  it  has  decoded  its  address,  verified  the  address  code, 
and  placed  the  requested  information  on  the  data  bus. 

When  the  requesting  module  receives  the  acknowledge,  it  lowers  the  re- 
quest line.  The  acknowledge  line  is  lowered  one  system  clock  period  after  it 

1 

is  raised  (except  under  certain  failure  conditions  in  the  memories  (cf.  Section 
5.3.3)). 

The  BFTSC  is  able  to  operate  in  two  addressing  modes  - the  soft  address 
mode  and  the  hard  address  mode  (cf.  Section  5.  2).  The  soft  address  mode  is 
used  for  all  normal  computer  operations;  the  hard  address  mode  is  used  only 
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by  the  CPUs  for  reconfiguration  and  test  purposes.  The  signal  on  the  hard/soft 
line  indicates  the  addressing  mode;  it  is  generated  by  the  active  CPU  and  received 
by  all  the  other  modules  on  the  bus. 

5.  1.4  INTERRUPT  BUS 

The  interrupt  bus  is  configured  as  shown  in  Figure  5-3.  There  are  two 
interrupts  (end-of-block  and  general)  generated  by  each  I/O  (DMA  and  SIU) 
module  and  bused  among  all  four  CPU  Modules.  Each  Timing  Module  generates 
one  real-time  interrupt;  it  is  bused  in  a loop  to  all  CPU  and  SIU  Modules  and 
returned  to  the  Timing  Module  to  be  monitored.  Interrupts  are  signalled  over 
these  lines  by  logic  level  "zero"  pulses  having  a duration  of  one  system  clock 
period.  All  interrupts  associated  with  one  module  of  a redundant  pair  are  elec- 
trically isolated  in  the  CPUs  and  SIUs  from  those  associated  with  the  other  module. 

One  fault  interrupt  line  emanates  from  each  of  the  three  CCUs  to  the  CPU 
complex;  they  are  voted  at  the  receivers  in  each  CPU.  Fault  interrupts  are 
signalled  by  logic  level  "one"  pulses  of  duration  equal  to  or  greater  than  one 
system  clock  period.  Each  of  the  three  fault  interrupt  lines  is  electrically  iso- 
lated at  the  receivers  from  the  other  two. 

The  arithmetic  and  illegal  op  code  interrupts  are  both  generated  and  used 
only  within  the  CPU  and  hence  do  not  require  intermodule  signal  paths. 

5.  1.  5 STATUS  BUS 

Figures  5-4  and  5-5  show  the  configuration  of  the  status  lines.  The  CCU 
dedicated  status  lines  (Figure  5-4)  are  shown  for  one  CCU;  each  of  the  other 
two  CCUs  has  an  identical  set  of  lines  to  all  of  the  modules  shown.  All  of  the 
lines  associated  with  one  CCU  Module  are  electrically  isolated  from  those 
associated  with  the  other  two  CCU  Modules  in  all  modules  to  which  they  con- 
nect. Each  non-CCU  dedicated  status  line  (or  pair  of  lines  for  power  and  timing 
status)  within  a group  (Figure  5-5)  is  electrically  isolated  from  all  the  other 
lines  (or  pair  of  lines)  in  that  group. 

There  are  two  power  status  lines  from  each  Power  Module  and  two  timing 
status  lines  from  each  Timing  Module;  a Power  or  Timing  Module  raises  both 
of  its  status  lines  when  it  is  in  the  active  state  and  its  outputs  are  within 
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tolerance.  A module  uses  the  outputs  trom  a Power  or  Timing  Module  only 
if  both  status  lines  associated  with  that  power  or  Timing  Module  are  valid  (logic 
level  "one”). 

There  are  three  clamp  lines  from  each  Circumvention  Module:  a CCU 
clamp,  an  I/O  clamp,  and  a Memory  clamp.  The  CCU  clamp  is  set  to  indi- 
cate to  the  CCU  that  a radiation  event  or  a power  switchover  is  taking  place. 

The  I/O  and  Memory  clamps  are  raised  to  indicate  power  switchover,  timing 
switchover,  radiation  event,  or  fault  interrupt.  The  I/O  clamp  connects  to  all 
I/O  modules  (DMAs  and  SIUs)  and  Memory  Modules;  the  Memory  clamp  connects 
to  all  Memory  Modules,  A clamp  is  indicated  by  a logic  level  "zero"  on  the 
clamp  lines. 

Each  CPU  sends  reconfiguration  program  flags  to  the  CCU  over  the  program 
flag  lines  associated  with  that  CPU  as  shown  in  Table  5-2.  One  of  seven  possible 
flags  is  signalled  by  the  CPU  by  placing  the  three  bit  code  for  Irat  flag  on  the 
status  lines  for  a duration  of  one  system  clock  period. 

Three  reconfiguration  status  signals  are  generated  by  each  CCU:  alexic; 
reconfiguration  mode;  and  reconfiguration  mode,  flag  1 not  set.  When  a logic 
level  "zero"  pulse  of  duration  equal  to  or  greater  than  one  system  clock  period 
occurs  on  the  alexic  line,  all  Memory,  DMA,  and  SIU  Modules  are  powered  off. 

The  reconfiguration  mode  line  indicates  that  the  reconfiguration  mode  has  been 
entered.  The  reconfiguration  mode,  flag  1 not  set  line  causes  all  bus  drivers  ► 

in  all  Memory,  DMA,  and  blU  Modules  to  inhibit  transmission.  The  drivers 
are  inhibited  as  long  as  this  signal  is  at  a logic  "zero"  level. 

i 

Each  CCU  receives  four  fault- indication  lines,  each  of  which  is  bused  f 

among  all  sources  of  that  fault  indication.  The  address  bus  fault  and  data  bus  ! 

fault  lines  are  bused  among  all  CPU,  DMA,  and  SIU  Modules  and  indicate  that 
an  address  bus  parity  fault  or  data  bus  parity  fault  has  been  detected.  A logic 

level  "zero"  pulse  of  duration  equal  to  or  greater  than  one  system  clock  period  i" 

signals  this  type  fault.  The  CPU  watchdog  timer  alarm  line  is  bused  among  all 

four  CPU  Modules;  it  is  generated  by  the  active  CPU  and  indicates,  with  a logic 

level  "one"  pulse  having  a duration  of  one  system  clock  period,  a lack  <'f  response 

to  a bus  transfer  request.  The  CPU  monitor  fault  line  is  bused  among  all  CPU 
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Modules;  it  is  generated  by  the  monitor  CPU  and  indicates  with  a logic  level 
"one"  pulse  having  a duration  of  one  system  clock  period,  a discrepancy  between 
the  monitor  and  active  CPU  Modules. 

In  order  to  indicate  the  source  of  an  address  or  data  bus  fault  report, 
four  lines  are  provided  to  each  CPU  Module.  One  line  is  bused  among  all  four 
CPUs,  one  is  bused  between  both  SIU  Modules,  one  is  bused  between  both  DMAl 
Modules,  and  one  is  bused  between  both  DMA2  Modules.  (The  DMA2  Modules 
are  not  present  in  the  BFTSC.  ) A pulse  generated  on  the  CPU  fault,  SIU  fault, 
DMAl  fault,  or  DMA2  fault  line  indicates  that  an  address  or  data  bus  fault  has 
been  detected  by  the  active  or  monitor  CPU,  the  powered  SIU,  the  powered 
DMAl,  or  the  powered  DMA2  respectively. 

Each  ecu  generates  two  active  CPU  select  lines  and  two  monitor  CPU 
select  lines.  When  the  two-bit  code  on  the  active  or  monitor  select  lines  corres- 
ponds to  the  preassigned  code  for  a particular  CPU,  that  CPU  is  powered  on 
as  the  active  or  monitor  CPU. 

, Each  ecu  generates  two  address  bus  rippler  state  lines  and  three  data 

bus  rippler  state  lines.  The  code  on  these  lines  determines  which  three  address 
bus  bytes  and  which  five  data  bus  bytes  are  active. 

The  first  eleven  hardware  status  bits  (cf.  Table  5-4)  are  generated  by 
each  CCU;  they  provide  information  to  the  CPU  Modules  regarding  the  state  of 
the  BFTSC  at  the  time  of  the  last  fault.  They  are  bused  among  all  CPU  Modules. 

5.1.6  TIMING  BUS 

Two  system  clock  lines,  one  from  each  Timing  Module,  arc  bused  in  a 
loop  to  all  BFTSC  modules  requiring  the  system  clock  and  back  to  the  Timing 
Module  in  order  to  be  monitored.  Each  clock  line  is  electrically  isolated,  at 
each  module,  from  the  other  line  so  that  no  single  fault  can  affect  more  than 
one  Timing  Module. 

Each  hardened  Timer  Module  generates  one  output  to  and  receives  one 
input  from  the  CPU  complex.  The  lines  associated  with  Each  Hardened  Tinier 
Module  are  electrically  isolated,  in  all  the  CPU  Modules,  from  thosf  associated 
with  the  other  Hardened  Timer  Modules.  When  in  the  count  down  mode,  the 
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Hardened  Timer  raises  its  output  line  each  time  one  stored  RTl  period  has 
been  counted.  The  output  line  is  lowered  whenever  the  reset  line  from  the  CPU 
is  pulsed  (logic  level  "one"  pulse  of  one  system  clock  period  duration). 

The  first  pulse  on  the  reset  line  begins  the  countdown  process. 

5.1.7  POWER  BUS 

Each  required  voltage  is  distributed  to  all  the  BFTSC  modules  by  two 
lines,  one  from  each  Power  Modvile.  Each  of  these  lines  is  bused  in  a loop  from 
the  Power  Module  to  all  other  modules  requiring  it  and  back  to  tlie  Power  Module 
to  be  monitored.  Two  energy  storage  lines  from  each  Power  Module  are  bused 
to  all  Timing,  Hardened  Timer,  and  Circumvention  modules;  they  provide  power 
to  those  modules  during  power  switchovers.  All  of  the  lines  associated  with 
one  Power  Module  are  electrically  isolated,  at  eacli  BTFSC  module,  from  those 
lines  associated  with  the  other  Power  Module  so  that  no  single  failure  can 
affect  both  Power  Modules. 

5.2  ADDRESS  SPECTRA 

In  order  to  facilitate  the  transmission  of  configuration  status  and  control  ^ 

information,  the  BFTSC  is  able  to  operate  using  two  addressing  modes:  a soft  j 

address  mode,  and  a hard  address  mode.  The  soft  address  mode  is  used  for  * 

all  normal  operations;  the  hard  address  mode  is  activated  only  by  tlie  CPU 

(usirig  the  store  hard  [STH]  instruction)  for  reconfiguration  and  test  purposes.  | 

5.2.1  SOFT  ADDRESS  SPECTRUM  1 

! 

The  BFTSC  has  a 64K  word  soft  address  spectrum  as  defined  in  Tables  i 

5-3  and  5-4.  The  first  60K  words  (0000  - E^FFF)  are  reserved  for  random  [ 

access  read/write  memory.  The  read/write  Memory  Module  configuration  can  i 

be  altered  under  program  control  by  changing  tlie  soft  name  (tlie  first  four  bits 
of  the  soft  address)  assigned  to  each  Memory  Module.  Tlie  soft  name  defines 

1 i. 

^ the  set  of  4K  addresses  to  which  the  module  will  respond  within  tlie  60K  spectrum. 

The  next  2K  words  (FOOO  - FTFE')  of  the  soft  address  spectrum  are  re- 

I 

served  for  the  reconfiguration  ROM  which  contains  the  recovery  program.  The 
' last  2K  words  of  the  soft  address  spectrum  (F800  - FFFF)  are  reserved  for  I/O 

i.  addressing  and  all  of  the  special  functions  required  for  the  BFTSC.  The  data 

bit  assignments  for  all  of  the  special  soft  addresses  are  listed  in  Table  5-4. 
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Table  5-3.  Soft  Address  Spectrum 


Soft  Address 

Assigned  Function 

OOOO-OFFF 

Memory  Module  assigned  soft  name  0 

1000-lFFF 

1 

Memory  Module  assigned  soft  name  1 

2000-2FFF 

Memory  Module  assigned  soft  name  2 

3000-3FFF 

Memory  Module  assigned  soft  name  3 

4000-4FFF 

Memory  Module  assigned  soft  name  4 

5000-5FFF 

Memory  Module  assigned  soft  name  5 

6000-6FFF 

Memory  Module  assigned  soft  name  6 

7000-7FFF 

Memory  Module  assigned  soft  name  7 

8000-8FFF 

Memory  Module  assigned  soft  name  8 

9000-9FFF 

Memory  Module  assigned  soft  name  9 

AOOO-AFFF 

Memory  Module  assigned  soft  name  A 

BOOO-BFFF 

Memory  Module  assigned  soft  name  B 

COOO-CFFF 

Memory  Module  assigned  soft  name  C 

DOOO-DFFF 

Memory  Module  assigned  soft  name  D 

EOOO-EFFF 

Memory  Module  assigned  soft  name  E 

F000-F3FF 

Reconfiguration  ROM 

F400-F7FF 

Not  assigned 

F800 

Hardware  Status  Word  1 

F801 

Hardware  Status  Word  2 

F802 

Monitor  CPU  Mask 

F803 

Peripheral  Mask 

F804 

Interrupt  Mask 

F805 

Downcount  Hardened  Timer 

F806-F808 

Not  assigned 

F809-F80F 

Program  Flags  to  CCU 

F810-F83F 

Not  assigned 

F840 

DMAl  Control/Status  Word  0 

F841 

DMAl  Control/Status  Word  1 

F842 

DMA2  Control/Status  Word  0 

F843 

DMA2  Control/Status  Word  1 

|L 
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Table  5-3.  Soft  Address  Spectrum  (Continued) 


Soft  Address 

Assigned  Function 

F844 

SIU  Control/Status  Word  0 

F845 

SIU  Control/Status  Word  1 

F846-FCAF 

Not  assigned 

FCBO-FCBE 

Not  assigned 

FCBF-FDCF 

Not  assigned 

FDDO-FDDE 

New  Rippler  Register  Low  Order  for  Soft 
Names  0-E 

FDDF-FE9F 

Not  assigned 

FEAO-FEAE 

Memory  Fault  Status  Register  for  Soft 
Names  0-E 

FEAF-FFBF 

Not  assigned 

FFCO-FFCE 

New  Rippler  Register  High  Order  for  Soft 
Names  0-E 

FFCF-FFFD 

Not  assigned 

FFFE 

Control  Data  Display 

FFFF 

Control  Panel 

* 


R AYTH  EON  COM P A N Y 

EQUIPMENT  DIVISION 


5 in 

5 

<0  ^ rt 

Q 

1*^1 
S iJ 

. •n  . 


t;  •-  > 

5 Q O 


o jS  > 

J T3 
p-ti  ■V 
O o o.'^ 

IT)  ^ tl 
4)  « -M 

«J  " 

^ O hS  0^ 


00  ^ o ^ (M  tr»  »-» 
^ ^ ^ (*0 
I I 

m nO 


<-1  ^ 

s S>-« 

(Nj  <u  '*:!  t! 

•4^  (T)  <0 

«)  u u 

^ u 

U ^ II  II 

in  .rt  *j 
bO  g X “d  O 
ifl  ID  2 -•  O 

Ui  N <!  ^ ^ 


rg  fo  Tt*  00 

I I 

O ITI 


- UJ  V-l 

i_  ^ o 

Q M JJ 

00  C 5 

I ^ C (fl  O 

l£l^  ° 

I U H ID  D 

■ > > 3 u 

' - - in  ^ 

' 1-1 
I (tJ  (tJ  C/5  5 

• U U D X 

II  II  ® 

^ v 
' O -*  D ,. 

I ^ -H 

I o o O w 


..  D 


^ d (Nj 

H«(n  OinQQu 
■ D D ^ II  II  II  II 
5 o o 

OjiUcnoo^--^ 


rtj  3 
4J  r^ 

c « 

a;  l—l  ^ 


Read/Write  control  line*  (1  = Read) 


Monitor  CPU  Mask  (F802)  24  Downcount  Hardened  Tinner*  (1  = Mask) 


R A V T^H  N COMPANY 

liJOinMf.  NT  ITIVISION 


X J<  X X X 
(i)  (0  (fl  u)  (0  CO  (n 

(T)  (T)  i^S 

2222222 

M II  II  II  II  II  II 


♦ * 
id  id 
u u * 
< < 


'S  'S  W u 

5 5 D ? in  in  T3 
S ^ 4J  ^ 

Q Q in  TJ  -o  3 u 

< < < 4)  nJ  4) 

PQ  CQ  OQ  cd  I «;  > 


lO  nO  r-  00  C'  o ^ 

<M  rsj  (NJ  <NJ  <NJ  CO  PO 


'^conncoaotoa) 

S,2S22222 


d w < CQ  < CQ 

CO 

uq:qqqqwu5 


<NJ(\Jpvirsj(Nirvjcoco 


XXXXXXXX 

cococoiococococn 

22222222 

M il  II  II  II  II  II  II 


fT5  (TJ  rtJ 

l-<  R R 

" “ ^ cQ  cq  OQ 

4)  41  4)  O O O 

o o o u u u 


522222 

m Q Q in  Q Q 


<\J<NJ(\J<MrsJojcocO 


Monitor  CPU  comparato 


5-2 


RAYTHEON  COMPANY 


f <J  I P M r NT 


VISION 


, -w  U n 

! 'S  o 

FQ  l-»  >N 

o e'^ 

’ -s 

O “>  « 

: 2 

«1  il  « 4;  -O 

I w nj  ^ -0 

.r4  .fH  •iH  ^ 

£ ati 

■§  c c ° 5 5 
►S  5 ^ 2;  w W 


rn 

•-^  CO 
I I 

rsj  oo^'-^oo-^'-HTf^sO 


b ffl  ^ «) 

» in  ^ < 

>••5  -2  ^ Q 

C -o  rt  > 

< < Q ^ > 


o ^ 
£ ao 
3 C 

S > 

>«  4J  4) 
(X)  V)  O 
=>  4> 

ffl  -)  a: 


(0 

to 

to  « 

CQ  S 

a,^ 

d < 

■t 

CO  4) 

a '~‘  ^ 
O >'*j 

»^  . fl) 

“•ti  S u 

..<  o; 

(tJ  >H  rc^ 

Q.OU  “ 

(t  i—i  ^2 

P3  Q S 


S^H  ^ 

^ o s £ 

-M  o 


™ n)  iU 

S.£  £^3 

guu  . 

UfflfQ  £ 

c 52  w ^ 

£ S ►J  u 

S £ £ £ - 

. !-•  Vj  1-1  iTj 

Q < < < ^ 


o— '(MfO'^t^'Or^oca'if' 


CO  o o o -<  X 
(M  o o — o X 
—I  o —I  o o X 


SIU  Status  'A'ord  1 (F845)  0-15  Same  as  Status  Word  0 

(Load)  16-31  Most  Recent  Store  Address 


• r4  *— < W 

to  3 

.2 


>-'  2 

-'  <t)  ? 
gCx.  O; 

o (t)  t! 

>-i  ^ ^ , 

'-'  (ti  5f  ^ 

<u  Q O 

■o  . 
o L ^1 

U S « 

<t)  P Oi' 

■S  « 

Q S ai  t 


(NJ 

<M  CO 
I I 
O CO 
rsj 


U) 

C) 

V.  £ 

« 4JW 

■J°d 

u 


RAYTHEON 


RAYTHEON  COMPANY 

EOUir>MENT  OlVISlON 

Except  for  the  store  to  hard  address  (STH)  instruction,  all  instructions  use 
the  soft  address  spectrum.  Addressing  a nonexistent  or  unpowerod  module  in 
the  Soft  address  mode  causes  a fault  interrupt  due  to  a lack  of  response  from  the 
addressed  device. 

5.  2.  2 HARD  ADDRESS  SPECTRUM 

Each  Memory,  DMA,  and  SIU  Module  lias  a unique  preassigned  five-bit 
hard  address  (listed  in  Table  5-5)  to  wliicli  it  responds  wlien  this  address  appears 
as  the  most  significant  bits  (bits  0-4)  on  the  address  bus  and  data  bus.  The  11 
bits  following  the  hard  address  define  the  function  performed  by  the  addressed 
module.  The  hard  address  functions  are  defined  in  Table  5-6.  The  definitions 
of  mnemonics  for  the  hard  address  functions  are  given  in  Table  5-7.  Simulta- 
neous recognition  of  its  hard  address  on  both  the  address  and  data  buses  in  the 
hard  address  mode  is  required  to  perform  any  of  the  hard  address  functions  ex- 
cept power-off.  Recognition  of  its  hard  address  combined  with  three  zeros  in 
bits  5-7  on  either  the  address  or  data  bus  in  the  hard  address  mode  is  sufficient 
to  turn  off  power  to  any  module. 

The  hard  address  mode  is  accessed  only  by  the  CPUs  using  the  store  to 
hard  address  (STH)  instruction  (cf.  Appendix  A).  Hard  addressing  does  not 
require  an  acknowledge  from  the  addressed  device;  therefore,  addressing  a 
non-existent  module  in  the  hard  address  mode  docs  not  cause  a fault  interrupt. 


Table  5-5.  Hard  Address  .Assignments 


Hard  Address 

Module 

0 

Not  Assigned 

1-24 

Memory 

25 

SIU  A 

26 

SIU  B 

27 

DMAl  A 

28 

DMAl  B 

^9 

DMA2  A 

30 

DMA2  B 

31 

Not  Assiened 
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Table  5-7.  Hard  Address  Function  Mnemonic  Di-finition 


Address 

Definition 

PWRON 

Power  On 

PWROFF 

Power  Off 

LDSFTN 

Load  Soft  Nanu' 

LDWP 

Load  Write  Protect 

IGW* 

Ignore  Write 

IGR* 

Ignore  Read 

STNEWST 

Set  New  Status 

EZPARA 

Enable  Zeros  Parity  on  Address 

TST  ONE 

Test  Ones 

TST  ZERO 

Test  Zeros 

STECORR 

Set  Error  Correction 

STRFRSH 

Set  Refresli 

AMRESET 

Master  Reset  Armed  Control  Functions 

UPDORR 

Update  Old  Rippler  Register 

FMRESET 

Master  Reset  Fault  Override  Functions 

EBADPARD 

Enable  Bad  Parity  on  Data 

EANLGFO 

Enable  Analog  Fault  Override 

ENWAFO 

Enable  Name  Compare,  Write  Protect, 

Address  Decode  Fault  Override 

IWMIS 

Word  Current  Missing 

CSSU 

Channel  Select  Fault 

ITDCLR 

Inhibit  Timing  Pulse  Data  Clear 

ITDCLK 

Inhibit  Timing  Pulse  Data  Clock 

ITID 

Itihibit  Timing  Pulse  Digit  Curiu'iit 

ITSTCH 

Inhibit  Timing  Pulse  Stack  Charge 

XAON,  XBON 

X Switch  Word  Select  A/B  on  Fault 

YAON,  YBON 

Y Switch  Word  Si-h'ct  A/B  on  Fault 

XAOFF,  XBOFF 

X Switch  Word  SeU'ct  A/B  Off  Fault 

YAOFF,  YBOFF 

Y Switch  Word  Si'lect  A/B  Off  Fault 

TMRESET 



Master  Reset  Test  Memory  Monitor  Functions 

* Dormant  Mode  is  set  by  setting  botli  IGW  and  IGR. 
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5.  3 SYSTEM  MODULES 

5.3.  1 CENTRAL  PROCESSING  UNIT  (CPU) 

The  BFTSC  contains  four  Central  Processing  Units  (CPUs),  two  of  which 
are  always  powered  during  normal  BFTSC  operation  with  one  denoted  by  the 
ecu  as  the  active  CPU  and  the  other  as  the  monitor  CPU.  The  monitor  com- 
pares all  control,  address,  data,  and  watchdog-timer  outputs  from  the  active 
CPU  with  its  own  internally  generated  signals.  The  monitor  infornis  the  CCU 
of  any  discrepancy  between  the  two  CPUs.  The  monitor  does  not  drive  any  out- 
puts other  than  those  dedicated  to  the  CCU. 

Figure  5-6  is  a block  diagram  of  the  CPU.  It  is  iniplenn'nted  in  five 
general  sections;  the  interface,  the  register  arrays  and  arithmetic  logic  unit 
(ALU)  section,  the  priority  interrupt  network,  the  control  section,  and  the  favilt 
nionitoring  and  configuration  status  section.  The  interface  section,  which  is 
always  powered,  contains  address-bus  and  data-bus  ripplers,  coders,  and  com- 
parators. It  serves  as  the  interface  between  the  CPU  and  all  internal  BFTSC 
buses.  [t  votes  on  the  logic  levels  of  the  ’’active'  CPU”  and  "monitor  CPU” 
status  lines  emanating  from  each  of  the  three  CCUs  and  generates  power  con- 
trol signals  in  accordance  with  this  information  to  power  on  the  remaining 
sections  of  the  CPU.  These  power  control  signals  are  raised  if  and  only  if 
either  the  active  CPU  or  the  monitor  CPU  status  lines  indicate  the  two-bit 
pattern  corresponding  to  the  two-bit  designation  preassigned  to  that  CPU. 

The  register  arrays  and  ALU  section  contain  the  arithmetic  logic  unit 
and  two  sets  of  8-word  by  32-bit  register  arrays.  The  eight  registers  in  one 
of  those  sets  serve  as  general  purpose  addressable  registers.  The  second  set 
of  registers  includes  the  extension  register,  progran\  counter,  memory  address 
and  memory  data  registers,  and  four  working  registers.  The  ALU  is  capable 
of  performing  all  of  the  arithmetic  and  logical  opi'rations  implied  by  tlu-  speci- 
fied instruction  set  (cf.  Appendix  A). 
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The  priority  interrupt  network  (PIN)  recognizes  the  ten  levels  of  interrupts 
identified  as  follows  (listed  in  order  of  decreasing  priority): 

Fault 

Illegal  Op  Code 
Arithmetic 
Real-Time  Interrupt 
SIU  (General) 

DMAl  (General) 

DMA2  (General) 

SIU  (End  of  Block) 

DMAl  (End  of  Block) 

DMA2  (End  of  Block) 

The  eight  lower  priority  interrupts  originate  as  pulses  from  the  requesting 
devices  and  are  stored  in  the  PIN  in  latched  flip-flops  (one  flip-flop  is  provided 
for  each  level).  The  eight  lower  order  interrupts  are  individually  maskable  under 
prograni  control.  If  the  mask  for  a given  interrupt  is  not  set  when  the  interrupt 
occurs,  or  when  the  mask  is  reset  following  the  occurrence  of  the  interrupt, 
the  request  is  processed  by  the  PIN  if  and  only  if  it  has  higher  priority  than  any 
other  pending  unmasked  interrupt.  The  PIN  causes  the  program  to  branch  to 
an  associated  interrupt  service  routine.  A return  address  and  appropriate 
status  information  (ALU  overflow,  carryout  and  divide-check  status,  interrupt 
enable /disable  status,  illegal  opcode  status  and  the  highest  priority  pending 
interrupt)  are  simultaneousiy  stored  into  preassigned  locations.  Servicing 
any  interrupt  causes  the  lower  priority  interrupts  to  be  disabled,  resets  the 
reqiif  at  flip-flop  for  the  level  being  serviced,  and  sets  an  "in-process"  flip-flop 
for  that  level.  It  is  possible  to  enable  and  disable  the  inti-rrupt  network  and  to 
reset  the  "in-process"  flip-flop  for  any  given  level  under  program  control. 

All  interrupts  except  the  fault  interrupt  and  the  illegal  op  code  interrupt 
are  honored  during  the  instruction  fetch  cycle.  Fault  and  illegal  op  code 
interrupts  are  honored  immediately  (at  the  next  microinstruction).  These 
interrupts  are  not  maskable.  A fault  interrupt  resets  all  in-process  and  re- 
quest flip-flops  and  is  serviced  even  if  a previous  fault  interrupt  is  still  in 
process. 
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The  control  section  (cf.  Figure  5-6)  contains  the  bus  arbiter,  the  micro- 
programmed control  unit,  the  instruction  register,  the  state  address  and  status 
registers,  and  the  end-condition  generator. 

The  bus  arbiter  (BA)  exercises  administrative  control  over  access  to  the 
address,  data,  and  control  buses.  The  BA  resolves  conflicting  bus  access  re- 
quests by  assigning  priority  in  a prescribed  cyclic  sequence.  Requests  from  the 
I/O  Modules  (SIUs  and  DMAs)  are  individually  maskable  by  loading  the  appro- 
priate mask  into  the  peripheral  mask  register  (cf.  Table  5-4). 

The  microprogrammed  control  unit  defines  the  microinstruction  control 
state  for  the  CPU  by  sequencing  through  its  control  state  decode  ROM.  The 
specific  ROM  sequence  is  determined  by  the  op  code  and  address  mode  fields 
of  the  instruction  (stored  in  the  instruction  register)  and  by  the  branch  condi- 
tions indicated  in  the  state  address  and  status  registers.  The  next  control  state 
is  generated  in  this  latter  unit  from  the  current  control  state  and  all  relevant 
CPU  control  and  data  variables.  The  end-condition  generator  generates  control 
signals  for  the  ALU  and  the  two  register  arrays  in  accordance  with  the  current 
microinstruction  control  state. 

The  fault  monitoring  and  configuration  status  section  includes  the  recon- 
figuration ROM,  the  flag  and  special  function  generator,  the  hardware  status 
word  registers,  the  monitor  mode  comparators,  the  watchdog  timer,  and  the 
fault  generator. 

The  reconfiguration  ROM  contains  all  program  routines  needed  to  recon- 
figure an  operational  BFTSC  system  following  a fault  and  a bootstrap  loader  for 
entering  programs  into  main  memory.  The  1024  word  by  32-bit  ROM  is  access- 
able  in  the  soft  address  mode  using  the  assigned  addresses  listed  in  Table  5-3. 

The  flag  and  special  function  generator  (FSFG)  is  also  addressable  in  the 
soft  address  mode  and  responds  to  the  (hexadecimal)  addresses  F800  through 
F805  and  F809  through  F80F  (cf.  Table  5-3).  The  FSFG  responds  to  addresses 
F800  through  F801  by  gating  the  contents  of  hardware  status  word  registers  1 
and  2,  respectively,  onto  the  internal  CPU  data  bus.  The  composition  of  these 
status  words  is  as  defined  in  Table  5-4.  Addresses  F802,  F803,  and  F804 
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causo  tho  FSFG  to  gate  the  appropriate  portion  (el.  Table  S--1)  of  tlie  word  on 
the  data  buti  into  the  monitor  CPU  mask  register,  the  peripheral  mask  register, 
and  thi'  interrupt  mask  register,  ri'spi'idively.  Addri-ss  F'SOS  I'auses  tlu*  FSFCi 
to  send  a pulse  to  the  hardened  timer  indii  ating  tliat  the  program  is  ready  to 
read  the  elapsed  time  recorded  by  that  di-viee.  Addresses  F809  through  F80F 
set  th»‘  program  flag  register,  which  is  monitored  by  the  CCU  lUid  used  to 
coordinate  reconfiguration  and  testing  procedures,  to  the  state  specified  by  the 
last  three  address  bits.  This  state  is  reset  to  000  after  one  system  clock  cycle. 

The  watchdog  timer  measures  the  time  interval  between  the  instant  a module 
(CPU,  DMA,  SIU)  is  given  access  to  the  bus  system  by  the  bus  arbiter  and  the 
instant  this  access  is  relinquished.  The  fault  generator  sends  a watclulog-timer 
alarm  of  one  system  clock  cycle  duration  to  the  CCU  sliould  the  watchdog-timer 
measure  a time  interval  exceeding  10  clock  cycles. 

The  monitor  mode  comparators  (MMC)  are  used  only  when  the  CPU  is 
in  the  monitor  mode.  When  this  is  the  case,  the  MMC  provides  a means  lor 
comparing  all  data,  address,  and  control  signal  outputs,  and  the  watchdog  timer 
alarm,  generated  by  the  active  CPU  with  the  corresponding  signals  generated 
(but  not  transmitted  externally)  by  the  monitor  CPU.  The  fault  gi-nerator  sends 
a CPU  fault  signal  of  one  clock  cycle  duration  to  the  CCU  sliould  tlie  MMC  delect 
any  discrepancy.  The  MMC  contains  a monitor  niask  register  wliich  can  be 
used  to  simulate  fault  conditions  and  hence  test  the  MMC's  monitoring  capability. 

If  a bit  in  the  monitor  mask  register  is  set  to  a "one"  (ct.  table  tlu' 

cor r e s ponding  monitor  CPU  input  to  the  MMC.  is  lompli'iiienti'd.  1 lu'  moniti>r 
mask  register  is  cleared  automatically  whenever  the  MMC  detects  a discrepancy. 

5.  3.  2 CONFIGURATION  CONTROL  UNIT  (CCU) 

The  Configuration  Control  Unit  (C'CU)  (cf.  Figure  5-7)  consists  of  three 
gi'neral  sectionsi  a CPU/bus  state  setpiencer,  a watcluli)g  tinuM*,  .ind  a tault 
interrupt  and  program  flag  decoder. 

The  CPU/bus  state  sequencer  section,  consisting  of  the  CPU/bus  stati- 
change  logic  and  the  CPU,  address  bus,  and  data  bus  state  sequencers  (cf. 

Figure  5-7),  determines  and  broadcasts  to  tlie  rest  of  tlie  system  tlie  identities 

of  the  active  and  monitor  CPUs,  tlie  tlirei'  active  adilress-bus  byli-s,  and  ttu' 

live  active  data-bus  bytes.  If  an  address-bus  state  changi'  is  indicated,  and  all  four 
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address  bus  states  have  already  been  tried  during  the  eurrent  reeontiguration 
mode,  a CPU  state  change  is  et't'ecteil  instead.  Similarly,  if  a ilata-bus  state 
change  is  indicated  and  all  six  data  bus  states  liave  already  been  tried  in  the 

current  reconfiguration  mode,  the  CPU  state  is  instead  changed.  It  six  CPII 
states  have  been  tried  during  the  current  reconfiguration  mode,  the  CCl'  signals 
the  entry  (or  reentry)  into  the  alexic  state  (see  below)  with  the  next  CPII  state 
change.  The  CPU  state  sequencer  sequences  CPU  states  in  such  a way  that  no 
CPU  is  powered  in  more  than  two  consecutive  states.  If  a given  CI’l'  state 
(i.  e.  , a specific  pair  of  powered  CPUs)  is  ever  repeated  dviring  any  continuously 
powered  period,  the  active  and  monitor  role  assignn\ents  are  reversed  from 
those  assignments  used  previovisly.  The  CPlVbus  state  sequencer  generates 
bits  9 and  10  of  HSW  1 (cf.  Table  5-4). 

The  watchdog  tiivier  measures  the  time  between  a fault  interrupt  and  the 
first  setting  of  a prograni  flag  (cf.  Table  5-2)  and  getierates  an  alarm  if  the 
time  exceeds  8192  clock  pulses. 

The  fault  interrupt  and  program  flag  decoder  section  inchules  a f.iult 
register,  a fault  interrupt  generator,  a priority  encoding  network,  a progr.im 
flag  decoder,  and  a program  flag  comparator. 

U’he  fault  rt'gister  contains  thirteen  flip-flops,  e.ich  of  which  is  set  uniquely 
by  one  of  the  following  signals:  CCU  clamp  (when  at  least  two  of  the  Ci rciunvention 
Units  indicate  a CCU  clantp  condition);  Tiniing  Module  fault  (when  one  or  both  of 
the  status  lines  associated  with  the  active  timiiig  moduli'  show  an  out -of-toleranc*' 
condition);  CPU  watchdog  timer  alarm;  CPU  fault  (from  the  monitor  moile  com- 
parator); CCU  watchdog  timer  alarm  (from  the  CCll's  owTi  watchdog  timer); 

CPU  interface  fault  (address  or  data  bus  code  p.irity  violation  iletected  by  thi' 

CPU  interface);  SIU  interface  fault;  DM.-\1  interfaic  fault;  OM.\2  interface  fault; 
data  bus  fault  (detected  by  a CPU,  Sill,  or  DM.'\  inte  rf.ici') ; aiidress  bus  fault 
(detected  by  a CPU,  SIU,  or  nM.\  interlace);  simplex  mode  ground  override; 
and  state -change  ground  override. 

The  latter  two  signals  originate  externally  to  the  UPl'SC'  .uni  provide  .i 
means  for  external  control  of  its  configuration.  The  simpli'x  mode  ground  over- 
ride signal  sets  (or,  if  previously  set,  resets)  a flip-flop  in  the  fault  registi'r 
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which  forces  the  BFTSC  into  (or  out  of)  the  simplex  mode.  In  the  simplex  mode, 
the  ecu  inhibits  certain  fault  interrupts  that  would  otherwise  be  generated  (see 
below)  and  changes  the  CPU  state  only  when  the  state-change  ground  override 
flip-flop  is  set.  The  state  of  the  simplex  mode  flip-flop  constitutes  bit  11  of 
HSWl  (cf.  Table  5-4). 

The  fault  interrupt  generator  generates  fault  interrupts  to  the  CPU  in 
response  to  the  fault  listed  in  Table  5-8,  If  faults  belonging  to  two  or 
more  categories  occur  simultaneously,  the  CCU  response  is  determined  by  the 
highest-priority  fault  category  or  subcategory.  (The  fault  categories  and  sub- 
categories in  Table  5-8  are  listed  in  descending  order  of  priority.)  The  fault 
interrupt  is  kept  raised  for  at  least  Z048  system  clock  cycles  for  all  faults 
resulting  in  a change  in  CPU  state  and  for  at  least  two  clock  cycles  for  all 
other  faults.  When  the  fault  interrupt  is  lowered,  the  fault  register  is  cleared. 

The  priority  encoding  network  encodes  the  state  of  the  fault  register  and 
generates  bits  5 through  8 of  Hardware  Status  Word  1 (cf.  Table  5-4)  indicating 
the  highest  priority  fault  currently  reported.  The  priority  encoding  network 
also  places  the  BFTSC  system  in  one  of  two  reconfiguration  states.  If  it 
announces  tlie  alexic  state,  the  power  to  all  Memory  and  I/O  Modules  is  auto- 
matically turned  off.  The  power  to  any  module  is  turned  back  on  only  if  that 
module  is  appropriately  addressed  in  the  hard  address  mode.  It  the  priority 
encoding  network  does  not  announce  the  alexic  state,  all  active  units  remain 
powered,  but  no  Memory  or  I/O  Module  responds  to  any  address  on  the  address 
bus  until  Flag  1 has  been  set  by  the  reconfiguration  program  (cf.  Table  5-2). 

The  priority  encoding  network  selects  the  alexic  reconfiguration  state  following 
all  CAT  I faults  and  when  the  appropriate  reconfiguration  program  flag  is  set 
(cf.  Table  5-2).  The  priority  encoding  network  generates  bit  4 of  HSWl  (cf. 

Table  5-4)  making  this  bit  a "one"  if  the  alexic  state  has  ever  been  entered  during 
the  current  reconfiguration  mode. 

The  program  flag  decoder  decodes  the  state  of  the  active  CPlT's  program 
flag  register  in  accordance  with  the  program  flag  definitions  siuiimar i/.ed  in 
Table  5-2  and  generates  the  appropriate  fault  masks,  HSWl  inputs  (bits  0-2; 
cf.  Table  5-4),  and  CPU  or  bus  state  change  signals.  Any  disagreement  between 
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the  active  and  monitor  CPU  program  flag  registers  is  detected  by  the  program 
flag  comparator  and  used  to  set  the  CPU  fault  flip-flop  in  the  fault  register. 

Any  attempt  to  set  Flag  1,  Flag  2,  or  Flag  i (I’rogram  Flags  100,  101,  or  110) 
while  either  Flag  2 or  Flag  "1  is  still  in  the  set  state  also  causes  the  CPU  fault 
flip-flop  to  be  set. 

5.  3.  3 MEMORY  MODULE  (MM) 

The  main  memory  in  the  BFTSC  is  composed  of  three  Memory  Modules. 
The  design  permits  expansion  to  fifteen  active  Memory  Modules  and  up  to  24 
total  Memory  Modules.  In  the  BFTSC,  two  Memory  Modules  are  active  and  one 
is  a spare.  One  of  the  Memory  Modules  is  implemented  with  non-v'olatile,  non- 
destructive read-out  (NDRO),  2-mil  plated  wire  in  order  to  demonstrate  the 
chosen  technology  for  the  FTSC.  The  otlier  Memory  Modules  are  implemented 
with  semiconductor  memory,  to  reduce  cost  and  weight.  They  are  dynamic 
NMOS  with  internal  refresh  so  that  special  control  or  timing  is  not  required  at 
the  module  interface.  The  semiconductor  Memory  Modules  are  powered  from 
separate  power  lines  in  order  to  simulate  non-volatility.  Four  dummy  Memory 
Module  loads  are  provided  to  simulate  additional  Meniory  Modules  on  the  data, 
address,  and  control  buses.  Capability  is  provided  to  replace  the  dunimy 
memories  with  additional  (external)  Memory  Modules. 

Figure  5-8  illustrates  the  Memory  Module  Fxinctional  Block  Diagram;  de- 
tails ot  the  Plated-Wire  Memory  Storage  Section  and  the  Semiconductor  Memory 
Storage  Section  are  shown  in  Figures  5-9  and  5 - 1 0 respectively . Fxinctionally , 
the  Meuiory  Modules  perform  in  the  following  manner. 

Upon  receipt  of  a request  in  the  soft  address  mode,  each  Menxory  Module 
compares  its  internally  stored  soft  nxodule  address  with  the  four  most  signi- 
ficant bits  of  the  soft  address.  If  a n^atch  is  obtained,  the  Memory  Module  per- 
forms the  function  defined  by  the  address  and  the  read/write  control  line.  The 
acknowledge  is  sent  when  the  operation  is  complete  and,  in  the  case  of  a read, 
when  the  data  is  on  the  bus.  A fault  detected  prior  to  acknowledge  inhibits  the 
acknowledge.  A fault  detected  during  the  acknowledge  lengthens  the  acknowledge 
enough  to  cause  a CPU  watchdog  timer  alarm.  In  all  cases,  a detected  fault 
sets  an  appropriate  bit  in  the  Memory  Modul»''s  fault  status  register  (cf.  Table 
5-4). 
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Figure  5-10.  Semiconductor  Memory  Storage  Section  Block  Diagram 
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The  validity  of  all  aiidressos  is  i-hocked  using  the  address  bns  error- 
detecting code  (cf.  Paragraph  5.  1.  1).  An  invalid  address  inhibits  resjiotjse  and 
sets  a fault  status  bit  in  all  modules.  When  write  operations  are  re<iuested,  the 
fifth  and  sixth  bits  of  the  address  are  t-ompared  to  the  write-protect  address  bits 
stored  in  a Memory  Modvile  register.  Invalid  write  reqxiests,  i.  e.  , into  a write- 
protected  area,  inhibit  response  and  set  a fault  st.itus  bit.  Address  decode  cir- 
cuitry is  protected  by  code  testing  and  selection  circuitry  is  protect  I'd  by  moni- 
toring to  prevent  false  address  selection.  The  Memory  Moduli'  has  monitors  to 
assure  that  it  actually  does  write  when  so  instructed. 

The  validity  of  all  received  data  is  checked  using  the  data  bus  error-detecting 
code  (cf.  Paragraph  1.2).  The  eiglit  parity  bits  associated  with  this  code  are 
then  converted  to  six  bits  capable  of  providing  single  error  correction;  these  six 
bits  are  retained  with  the  data  througliout  all  subsecpient  memory  operations. 

Invalid  data  causes  the  memory  either  to  inhibit  or  to  lengflien  its  acknowledge 
(depending  upon  when  the  fault  is  detected)  and  to  set  the  appropriate  bit  in  its 
fault  status  register. 

The  bit  rippler  contains  two  ripplcv  state  registers,  the  old  rip[)ler  register 
which  normally  determines  the  rippler  state,  and  the  new  i-ippler  register  which 
can  be  designated  the  rippler  state  controller  by  addressing  thi'  Memory  Module 
with  the  appropriate  hard  address  (cf.  Table  5-t').  It  is  possible  to  read  or 
write  into  the  new  rippler  register  under  [irogram  control  and  to  force  the  rippler 
into  either  of  two  test  r>\odes.  During  "test  ’/.eros"  mode,  all  "/.cros"  may  be 
written  into  any  location.  A bit  in  tlu-  new  rippler  register  is  set  to  a "om',  " 
regardless  of  its  previous  setting,  if  the  corresponding  bit  in  any  word  read  iron\ 
the  Memory  Module  is  a "one.  " Similarly,  in  the  "test  ones"  mode,  all  "ones" 
may  be  written  into  any  location.  A new  rippler  register  bit  is  set  to  a "one" 
if  the  corresponding  bit  is  a "zero"  when  read. 

It  is  also  possible  to  operate  the  Memory  in  .m  " er  r or -cor  r t'ct  ing  mode" 
and  in  a "self- ref r esh  mode".  In  the  former  mode,  any  single  erroneous  bit  is 
corrected  automatically  whenever  a word  is  read  from  the  Memory  Moduli'.  In 
the  latter  mode,  all  read  accesses  use  the  old  rippler  register  and  all  write 
accesses  use  the  new  rippler  register.  In  addition  single  liit  errors  are  corrected 
as  in  the  error-correcting  mode.  This  permits  a Memory  Module  with  a faulty  bit 
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line  to  be  "repaired"  by  sequentially  reading  and  then  writing  into  each  of  its 
4096  words.  Both  modes  can  be  entered  under  program  control  by  addressing 
the  Klemory  Module  in  the  hard  address  mode  (cf.  Table  *S-ti  for  the  menu)ry 
hard  address  functions). 

A memory  clamp  signal  is  triggered  by  signals  receivecl  from  the  three 
Circumvention  Modules.  If  at  least  two  of  these  Circumvention  Module  signals 
indicate  a clamped  condition,  the  Memory  Module  inhibits  all  operation  and 
clamps,  or  shvuits,  the  word  drive  current  so  that  no  data  in  memory  is  lost 
during  power  failures  or  circumvention  events. 

Each  Memory  Module  is  assigned  its  fovir-bit  soft  name  under  program  con- 
trol (cf.  Table  5-6)  and  responds  to  any  properly  encoded  address  prefixed  with 
these  four  bits  by  accessing  the  location  defined  by  the  remainder  of  the  address. 

In  addition  each  module  responds  to  the  soft-mode  (hexadecimal)  addresses  FEAX, 
FDDX,  and  FFCX  (cf.  Table  5-4)  when  "X"  is  its  current  soft  name.  In  response 
to  the  address  FEAX,  the  module  gates  the  contents  of  its  Fault  Status  Register 
onto  the  data  bus  and  subsequently  resets  the  register.  Addresses  FDDX  and 
FFCX  provide  access  to  bits  32-40  and  bits  0-31,  respectively,  of  the  new  rippler 
register. 

Each  Memory  Module  also  responds  to  all  properly  encoded  addresses  in 
the  hard-address  mode  prefixed  with  its  unique  five-bit  hard  address.  The 
specific  response  to  each  such  address  is  as  specified  in  Table  5-6.  The  "fault 
override  functions  allow  the  memory  to  respond  normally  when  the  indicated 
faults  are  present.  The  "arm  test  memory  monitor"  functions  provide  a means 
for  testing  all  memory  monitors  by  simulating  fault  conditions.  They  are  reset 
automatically  upon  the  occurrence  of  the  simulated  fault, 

5.  3.  4 SERIAL  DATA  BUS 

The  Serial  Data  Bus  subsystem  (Figure  5-11)  provides  the  BFTSC  with 
three  external  interfaces  and  allows  expansion  to  62  external  interfaces.  The  basic 
elements  of  the  Serial  Data  Bus  subsystem  are  the  dual  - redundant  Serial  Inter- 
face Unit  (SIU),  which  controls  bus  communications,  and  the  dual  - redundant  De- 
vice Interface  Units  (DIUs)  at  each  of  the  interfaces.  Only  one  of  the  two  SlUs 
is  powered  at  a time;  both  of  the  DIUs  .at  each  interface  are  powered  continuovisly. 
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The  SIU  is  capable  of  transferring  blocks  of  words  between  the  serial  data 
bus  and  main  memory  by  utilizing  a direct  memory  access  capability.  The  SIU 
is  also  capable  of  transferring  serial  data  bus  words  on  a single  word  basis  util- 
izing an  interrupt  capability  to  notify  the  CPU  of  user  requests. 

Transmission  on  the  bus  consists  of  positive  and  negative  pulses  of  one-half 
system  clock  period  duration  separated  by  a one-half  system  clock  period  of  in- 
activity. Four  combinations  of  pulses  are  transmitted  on  the  serial  bus  (cf. 

Figure  5-12);  a logic  1 consisting  of  a positive  pulse  followed  by  a negative  pulse, 
a logic  0 consisting  of  a negative  pulse  followed  by  a positive  pulse,  a "word 
sync"  (preceding  each  word  except  the  first  word  in  each  frame)  consisting  of 
three  negative  pulses  followed  by  three  positive  pulses,  and  a "frame  sync" 
(preceding  the  first  word  in  each  frame)  consisting  of  three  positive  pulses  fol- 
lowed by  three  negative  pulses.  A serial  data  bus  frame  begins  with  each  real- 
time interrupt.  It  consists  of  128  serial  bus  words,  and  has  a duration  of  1 1008 
system  clock  cycles  (for  the  present  RTI  period). 

Each  transmitted  40-bit  serial  data  bus  word  is  preceded  by  one  of  the  two 
sync  pulse  sequences,  neither  of  which  is  valid  as  normal  data.  The  8-bit  error 
detection  code  used  on  the  internal  RF'TSC  data  bus  (cf.  Section  5.  1.2)  is 
appended  to  the  32-bit  data  word  transmitted  on  the  bus.  The  code  is  maintained 
on  each  data  word  from  Memory  to  SIU  to  DIU  to  SIU  and  back  to  Memory.  An 
example  of  the  serial  data  bus  waveforms  is  illustrated  in  Figure  5-12. 

The  serial  bus  is  a r econfigu rable  daisy-chain  system  with  dual-redundant 
serial  links  between  each  contiguous  pair  of  DIUs  along  the  bus.  Transmission 
on  the  bus  is  in  one  direction  only.  The  bus  data  transmitted  by  the  SIU  is  de- 
tected, reconstructed  and  repeated  or  modified  at  each  DIU,  thereby  limiting  the 
length  of  bus  to  be  driven  by  any  DIU  transmitter. 

Each  of  the  dual  DIUs  provides  a 20-bit  parallel  interface  for  tlie 
peripheral  device  with  which  it  is  associated.  It  receives  its  power  from  its 
associated  peripheral  device  and  shares  the  same  housing.  Each  DIU  selects 
one  of  the  two  serial  bus  lines  and  demodulates  and  decodes  the  received  informa- 
tion. The  DIU  monitors  the  selected  bus  for  faulty  bus  transmissions  and  switches 
to  the  alternate  bus,  if  a signal  is  present  on  that  bus,  as  soon  as  a fault  condi- 
tion is  detected  on  the  information  being  received.  Relays  arc  provided  for  by- 
passing a DIU  pair  should  the  associated  peripheral  lose  power. 
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Figure  5-12.  Serial  Data  Hus  Waveforms 
5.  3.4.  I Serial  Inferface  Unit  (SIU) 

The  SIU  provides  the  interface  between  the  compviter  and  the  serial  data 
bus.  Figure  5-13  shows  the  functional  features  of  the  SIU.  The  SIU  is  program 
controlled  with  two  assigned  addresses.  These  addresses  are  used  to  send 
control  words  to  the  SIU  (in  the  write  mode)  and  to  read  the  SIU  status  (in  the 
read  mode).  The  formats  for  these  words  are  shown  in  Figure  5-14.  The  con- 
trol words  are  used  for  testing  purposes  and  to  set  up  a block  transfer,  i.  e.  , 
to  specify  the  start  and  stop  addresses  in  memory  where  the  block  to  be  trans- 
ferred is  located.  When  a data  transfer  is  initiated,  the  SIU  sequentially  reads 
words  from  the  memory  locations  in  the  specified  block,  places  the  words  on  the 
serial  bus,  and  writes  the  returned,  possibly  altered,  words  back  into  the  loca- 
tions from  which  they  were  read.  Normally,  the  block  is  initiated  with  the 
seventh  serial  data  bus  word  after  a real-time  interrupt.  If  the  "immediate" 
bit  (cf.  Figure  5-14)  is  set,  however,  the  SIU  begins  the  specified  block  transfer 
with  the  next  available  serial  bus  word.  In  either  case,  the  "busy"  bit  in  status 
word  0 is  set  when  the  block  transfer  begins  and  is  reset  when  it  has  been  com- 
pleted. 

The  SIU  is  prevented  fron\  accessing  an  incorrect  address  by  the  error 
code  incrementing  scheme  shown  in  Figure  5-15.  The  error  code  appended  to 
the  first  address  of  the  block  is  created  by  modifying  the  error  code  of  the  data 
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STOP  ADDRESS 

START  ADDRESS 

0 X X X - NORMAL  BLOCK 

1 X X X - IMMEDIATE  BLOCK 

X 0 0 1 - SWITCH  RECEIVE  BUS 

X 0 I 0 - INVERT  LAST  ERROR  CODE  BIT 

X 0 I I — ZERO  ERROR  CODE  BITS 

X I 0 0 - INHIBIT  ERROR  CODE  BITS 

X I 0 I - INVALIDATE  LAST  ERROR  CODE  BIT 

X I I 0 - INVALIDATE  FIRST  SYNC  BIT 


STATUS  WORD  0 
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MRAR  (FETCH) 

BAD  PARITY  ON  SERIAL  BUS 

RCVING  BUS  A 

LAST  MEM  ACCESS  FETCH 

BUSY 

INTERNAL  FAILURE 
WDT-BA 

INVALID  WAVEFORM  ON  SERIAL  BUS 
DATA-BUS  FAULT 
ADDRESS  BUS  FAULT 
ANY  FAILURE 


STATUS  WORD  I 
15  16 


SAME  AS  STATUS  WORD  0 


MRAR  (STORE) 


Figure  5-14.  SIU  Word  Formats 
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word  used  to  initiate  the  block.  The  error  code  for  the  next  address  is  generated 
by  modifying  the  error  code  of  the  present  address  using  the  present  address. 

This  error  code  scheme  insures  that  any  address  accessed  out  of  sequence  by 
the  SIU  is  accompanied  by  an  incorrect  error  code  on  the  address  bus.  Due  to 
the  capability  of  the  error  code  to  detect  any  number  of  failures  within  a single 
byte,  end-of -block  is  detected  when  any  two  of  the  three  bytes  of  the  address  and 
its  error  code  in  the  address  register  match  those  in  the  stop  address  register. 

If  the  third  byte  does  not  match  at  this  time,  an  error  is  indicated. 

The  serial  data  bus  word  format  is  as  shown  in  Figure  5-16.  A word  is 
taken  from  main  memory  by  the  SIU,  circulated  on  the  serial  data  bus  and  stored 
back  in  the  memory  location  from  which  the  word  was  originally  read.  Any 
changes  which  a DIU  makes  to  a serial  data  bus  word  being  transmitted  or  received 
are  made  while  preserving  the  integrity  of  the  error-detection  code.  When  the 
last  word  of  a specified  block  has  been  stored  in  memory,  an  end-of-block  (EOB) 
interrupt  is  sent  to  the  CPU. 

The  priority-interrupt  field  of  the  serial  data  bus  word  is  used  for  three 
purposes: 

a.  Inform  the  SIU  that  the  DIU  has  a priority  interrupt  for  the  CPU. 

In  this  case,  the  ACK  bit  is  zero  and  the  priority  interrupt  field 
contains  the  address  of  the  interrupting  DIU. 

b.  Inform  the  DIU  that  the  CPU  has  received  the  priority  interrupt. 

In  this  case,  the  ACK  bit  is  set  to  a one  and  the  priority 
interrupt  field  contains  the  address  of  the  DIU  to  be  acknowledged. 

c.  Inform  subsequent  DIUs  and  the  SIU  that  the  previous  word  did 
not  pass  the  code  or  waveform  integrity  checks  (all  ones  in  the 
priority  interrupt  field). 

The  SIU  notifies  the  CPU  of  a DIU  priority  interrupt,  a serial  bvis  code  or 
waveform  integrity  fault,  an  internal  error,  a lack-of-response  error  (from  the 
CPU  bus  arbiter),  or  address  and  data  bus  coding  errors  by  providing  a general 
interrupt  to  the  CPU.  The  CPU  determines  the  cause  of  the  interrupt  by  reading 
SIU  status  word  0.  Also  included  in  status  word  0 is  the  SIU's  most  recent  fetch 
address  register  (MRAR-Fetch)  which  contains  the  memory  address  most  re- 
cently accessed  by  the  SIU  in  the  fetch  mode.  (The  interrupt  indicators  and  the 
DIU  priority-interrupt  field  of  the  status  word  are  cleared  to  zero  when  status 
word  0 is  read  by  the  CPU.  ) Status  Word  1 includes  the  SIU's  most  recent  store  address 
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The  ACK  and  Priority  Interrupt  fields  are  <lotailed  below  in  order  of  decreasiii}^ 
priori!  y. 


PRIORI  l Y 
ACK  INl’KRRUPT 


X 


111111 


Error  detection  flay.  Transmitted  by  DIU  if  previous 
word  had  faulty  EDC. 


1 

1 

0 

0 

X 


to 


to 


111110 
000001 
1 1 1 1 10 
000001 
000000 


Acknowledgement.  A DIU  interrupt  is  acknowledged  by 
transmitting  a one  in  the  ACK  bit  and  the  DIU  address  in 
the  Priority  Interrupt  field. 


Priority  Interrupt.  The  DIU  transmits  its  address  in  the 
Priority  Interrupt  field  when  computer  access  is  desired. 
The  DIU  transmits  in  this  field  only  if  its  priority  is 
higher  than  the  PI  received. 


This  is  the  normal,  no  interrupt,  state  of  the  I’l  field. 

Addresses  111111  and 


DIU  ADDRESS  --  Six-bit  DIU  address  field  from  the  SIU. 
000000  are  not  assigned. 


OPCODE 

BIT  1 3 

BIT 

0 

0 

0 

1 

1 

0 

1 

1 

NEW  DATA 

.MESSAGE 

- Instruction  to  DIU. 


Receive  Message  (SIU  to  DIU) 
Receive  Command  (SIU  to  DIU) 
Transmit  Message  (DIU  to  SIU) 
Transmit  Status  (DIU  to  SIU) 


The  DIU  sets  the  new  data  bit  to  a one  when  it  accepts  the  word 
or  when  a transmitted  message  has  been  updated  by  the  user 
since  the  last  transmission.  If  the  word  is  not  accepted  or  the 
transmitted  message  has  not  been  updated,  the  DIU  sets  tlie  new 
data  bit  to  a zero.  A command  is  used  only  by  the  DIU  (it  is  not 
sent  to  the  user),  if  the  new  data  bit  is  a one. 


--  lb-bit  niessage  word  transmitted  to  or  from  DIU  dt'pending  on  tlic 
indicated  op  code. 


ERROR  DETECTION  CODE  --  8-bit  code  used  for  error  detection  on  the  bu.s.  llu 


code  is  identical  to  the  byte  parity  code  used  on  the  data  ljus. 


It 


.n 


It 


Figure  5-lt>.  Serial  Data  Bus  Word  Format 
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register  (MRAR-Store)  containing  the  last  memory  address  accessed  by  the  SlU 
in  the  store  mode. 

5 . 1.4.  2 Device  Interface  Unit  (DlUl 
S.  3.  4.  2.  1 Module  Description 

When  addressed,  a DRl  (cf.  Figure  5-17)  either  receives  a message  or  a 
command,  or  transmits  a message  or  a status  word,  as  indicated  by  the  instruc- 
tion op  code.  (The  serial  data  bus  word  format  is  as  defined  in  Figure  5-16.  ) 

As  a serial  word  is  shifted  into  the  DlU,  each  bit  is  tested  to  determine  if  it  is 
consistent  with  the  Dili's  pin-programmed  address.  When  the  DILI  detects  its 
own  address,  it  performs  the  following: 

• If  the  op  code  indicates  receive  message  and  the  DIU  is  able  to 
accept  the  message,  the  new  data  bit  is  set  to  a one,  the  error 
code  is  modified  accordingly,  and  the  message  is  sent  to  the 
peripheral. 

• If  the  op  code  indicates  receive  command,  the  DILI  checks  the 
new  data  bit.  If  the  new  data  bit  is  a one,  the  DIU  performs  the 
command  indicated  by  the  first  eight  bits  of  the  command  word. 

If  the  new  data  bit  is  a zero  and  the  DIU  can  accept  the  command, 
the  new  data  bit  is  set  to  a one,  the  command  is  sent  to  the 
peripheral,  and  the  command  indicated  by  the  first  eight  bits  of 
the  command  word  is  performed  by  the  DIU. 

• If  the  op  code  indicates  transmit  message,  the  DIU  sets  the  new 
data  bit  to  a one  and  transmits  the  message  only  if  the  message 
has  been  updated  by  the  user  since  the  last  time  it  was  trans- 
mitted. 

• If  the  op  code  indicates  transmit  status,  the  DILI  sets  the  new 
data  bit  to  a one  and  transniits  the  status.  The  first  eight  bits 
of  the  message  field  are  reserved  for  DIU  status  and  the  second 
eight  bits  for  peripheral  status. 

The  DIU  command  and  status  word  formats  are  defined  in  Figure  5-18. 

5.  3.  4.  2.  2 DIU / Per ipheral  Interface 

Data  transfers  between  the  DIU  and  the  peripheral  are  implemented  with 
twenty  bi-directional  data  lines  and  nine  control  lines:  data  request,  interrupt 
request,  read/write,  command/data,  and  half  word  control  lines  from  the  DIU 
to  the  peripheral,  and  acknowledge,  device  interrupt,  busy,  and  error  code  con- 
trol lines  from  the  peripheral  device  to  the  DIU. 


Figure  5-17,  DIU  Module  Functional  Block  Diagram 
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rhi'  (lata  roqiu'st  lino  is  raisod  by  tlu'  PIU  to  iiiitititt'  a diifa  (raiisftM*  (t>  or 
from  tiu'  poriphoral  or  fo  (ransfor  a comiiiaiul  to  fbo  poriplioral.  Whon  this  lino 
is  raisoti,  tho  poriphoral  rosponds  .iccordinj;  to  tlio  state's  of  tlu'  othor  control 
lines. 

Tho  roati/writo  lino  imlicatos  tho  direction  of  tho  transfer.  It  is  stM  to  tho 
hi>*h  state  whon  tho  transfer  is  from  tlu*  poriphoral  to  tho  OIU  and  tho  lino  is  sot 
low  whon  information  is  to  ho  transmitti'd  from  tho  PIU  to  tho  ptM*i|iluM*al. 

rho  comma nd /tiat.i  lino  distinguishes  lu'twoon  t'lunmand  information  and 
<lata.  If  this  lino  is  at  .i  high  state,  information  transmitti'd  from  tho  nil)  to  tho 
peripheral  is  intorprotoil  as  a command.  If  this  lino  is  .it  a low  st.iti',  information 
t ransmitti'd  in  I'ithc'r  iliroction  is  int  I'r  |ir  I't  I'd  as  d.ifa.  Should  the  periplu'ral  he 
'i^iii^  error  lode,  tlu*  information  is  transferred  hi'twet'ii  thi'  PIU  and  tho  pi'riphoral 
t\%.'  .*0-hit  half  words.  The  h.ilf  wonl  control  lino  is  usi'd  hy  tlu'  PIU  to  indicate 
' t ilf  v^tird  is  iM'ing  t r.insfi'rrt'd.  If  this  lino  is  low,  the  first  lialf  is  being 
f ei(  f If  Is  high,  the  second  half  is  being  t ransft'i*  red,  I'hoso  two  half 
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bits  0-15  of  half  word  1 followed  by  bits  0-15  of  half  word  2 form  the  32  bits  of 
data.  Bits  16-19  of  half  word  1 followed  by  bits  16-19  of  half  word  2 form  the 
eight  bits  of  error  code. 

The  interrupt  request  line  is  raised  by  the  DIU  in  response  to  a device 
interrupt  in  order  to  transfer  status  from  the  peripheral  to  the  DIU.  (In  the 
FTSC  this  line  is  combined  with  the  data  request  line.  In  order  to  read  status, 
the  command/data  line  is  set  high  and  the  read/write  line  is  set  high.  ) 

The  acknowledge  line  is  raised  by  the  peripheral  after  a transfer  has  been 
I requested  by  the  DIU  and  the  peripheral  has  produced  (gated  onto  the  data  lines) 

the  data/status  or  accepted  the  data/command  being  transferred. 

Peripheral  initiated  data  transfers  are  accomplished  using  the  device  in- 
terrupt line.  When  this  line  is  raised  by  the  peripheral,  the  DIU  raises  its  in- 
terrupt request  line  in  order  to  read  the  status  from  the  peripheral.  The  device 
interrupt  is  lowered  before  the  transfer  is  completed. 

The  busy  line  is  raised  by  the  peripheral  to  indicate  that  it  is  unable  to 
accept  commands.  When  this  line  is  high,  the  DIU  sets  the  device  busy  bit  in  its 
status  word.  The  status  bit  is  reset  when  the  busy  line  is  lowered  by  the  periph- 
eral. 

The  error  code  control  line  from  the  peripheral  is  used  to  indicate  whether 
or  not  error  code  is  being  transmitted.  If  the  level  on  this  line  is  high,  the  four 
least  significant  bits  of  each  of  the  two  20-bit  half  words  are  concatenated  to  pro- 
duce the  eight  code  bits  for  the  word.  If  this  line  is  low,  only  one  half  word  is 
transferred  which  contains  the  16  message  bits  of  the  serial  bus  word. 

5.  3.  5 DIRECT  MEMORY  ACCESS  MODULE  (DMA) 

5.  3.  5.  1 Module  Description 

The  DMA  channel  is  utilized  for  high-speed  peripheral  access  fo  the  l^ETSC. 
The  DMA  (cf.  Figure  5-19)  is  program  controlled  and  responds  to  two  control  ad- 
dresses. The  first  address  is  used  to  send  the  DMA  data  transfer  control  words 
and  to  read  the  first  status  word;  the  second  address  is  used  to  initiate  certain 
monitor  tests,  to  send  commands  to  the  peripheral  and  to  receive  requests  from 
the  peripheral.  (The  word  formats  are  shown  in  Figure  5-20.)  Data  transfers 
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to  or  from  the  peripheral  are  established  by  first  sending  commands  to  the  periph- 
eral (DMA  control  word  1). 

Once  the  peripheral  device  is  initialized  for  a data  transfer,  the  CPU  sends 
a command  word  to  the  DMA  (DMA  control  word  0)  to  tell  it  the  start  address, 
the  stop  address,  whether  it  is  transmitting  or  receiving,  and  whether  to  start 
or  stop  the  transfer.  If  the  DMA  is  commanded  to  start  a transfer,  it  sets  the 
busy  bit  in  its  status  word,  and  places  the  start  address  in  a counter.  The  counter 
is  incremented  as  each  data  word  is  transferred  to  or  from  memory.  When  the 
contents  of  this  counter  equal  the  stop  address,  the  DMA  ceases  data  transmission, 
resets  the  busy  bit,  and  raises  an  end-of-block  interrupt  to  the  CPU. 

The  DMA  is  prevented  from  accessing  an  incorrect  address  by  the  error 
code  incrementing  scheme  shown  in  Figure  5-15.  The  error  code  appended  (o 
the  first  address  of  the  block  is  created  by  modifying  the  error  code  of  the  data 
word  used  to  initiate  the  block.  The  error  code  for  the  next  address  is  generated 
by  modifying  the  error  code  of  the  present  address  using  the  present  address. 

This  error  code  scheme  insures  that  any  address  accessed  out  of  sequence  by 
the  DMA  is  accompanied  by  an  incorrect  error  code  on  the  address  bus.  Due  to 
the  capability  of  the  error  code  to  detect  any  number  of  failures  within  a single 
byte,  end-of-block  is  detected  when  any  two  of  the  three  bytes  of  the  address  and 
its  error  code  in  the  address  register  match  those  in  the  stop  address  register. 

If  the  third  byte  does  not  match  at  this  time,  an  error  is  indicated. 

The  DMA  notifies  the  CPU  of  a user  interrupt,  a control  word  error,  an 
internal  error,  a lack-of-response  error  (from  the  CPU  bus  arbiter),  address 
and  data  bus  coding  errors,  and  a command  transferred  to  the  use’-,  by  providing 
a general  interrupt  to  the  CPU.  The  CPU  determines  the  cause  of  the  interrupt 
by  reading  DMA  status  word  0.  Also  included  in  status  word  0 is  the  most 
recent  address  register  (MRAR)  which  contains  the  memory  address  most 
recently  accessed  by  the  DMA.  (The  interrupt  indicators  in  the  status  word  are 
cleared  to  zero  when  it  is  read  by  the  CPU.  ) In  the  case  of  a user  interrupt, 
status  word  1 contains  the  user  status. 
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5.  3.  5.  2 DMA/ Peripheral  Interface 

Data  transfers  between  the  DMA  and  the  peripheral  are  inipleinented  with 
twenty  bi-directional  data  lines  and  nine  control  lines:  data  request,  interrupt 
request,  read/write,  command/data,  and  half  word  control  lines  from  the  DMA 
to  the  peripheral,  and  acknowledge,  device  interrupt,  busy,  and  error  code  con- 
trol lines  from  the  peripheral  device  to  the  DMA. 

The  data  request  line  is  raised  by  the  DMA  to  initiate  a data  transfer  to  or 
from  the  peripheral  or  to  transfer  a command  to  the  peripheral.  When  this  line 
is  raised  the  peripheral  responds  according  to  the  states  of  the  other  control 
lines. 

The  read/write  line  indicates  the  direction  of  the  information  transfer.  It 
is  set  to  the  high  state  when  the  transfer  is  from  the  peripheral  to  the  DMA;  the 
line  is  set  to  the  low  state  when  the  transfer  is  from  the  DMA  to  the  peripheral. 

The  command/data  line  distinguishes  between  command  information  .and 
data.  If  this  line  is  at  a high  state,  then  information  transmitted  from  the  DMA 
to  the  peripheral  is  interpreted  as  a conjmand.  If  this  line  is  at  a low  state,  in- 
formation transmitted  in  either  direction  is  interpreted  as  data. 

Information  transferred  between  the  DMA  and  the  peripheral  is  transmitted 
as  two  20-bit  half  words.  The  first  half  word  consists  of  the  16  most  significant 
data  bits  and  the  four  most  significant  error  code  bits  of  the  40-bit  internal  data 
bus  word.  The  second  half  word  consists  of  the  16  least  significant  data  bits  and 
the  four  least  significant  error  code  bits  of  the  word.  The  half  word  control  line 
indicates,  when  low*  that  the  first  half  word  is  being  transferred  .and,  when  high, 
that  the  second  half  word  is  being  transferred. 

The  interrupt  request  line  is  raised  by  the  DMA  in  response  to  a device 
interrupt  in  order  to  transfer  status  from  the  peripheral  to  the  DMA.  (In  the 
FTSC  this  line  is  conibined  with  the  data  request  line.  In  order  to  read  status, 
the  command/data  line  is  set  high  and  the  read/vvrite  line  is  set  high.  ) 

The  acknowledge  line  is  raised  by  the  peripheral  after  a tr.ansfer  has  been 
requested  by  the  DMA  and  the  peripheral  has  produced  (gated  onto  the  data  lines) 
the  data/ status  or  accepted  the  data/command  to  be  transforretl. 
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Peripheral  initiated  data  transfers  are  accomplished  usinjj  the  device 
interrupt  line.  When  this  line  is  raised  by  the  peripheral,  the  DMA  raises  its 
interrupt  request  line  in  order  to  read  the  status  from  the  peripheral.  The  de- 
vice interrupt  is  lowered  before  the  transfer  is  completed. 

The  busy  line  is  raised  by  the  peripheral  to  indicate  that  it  is  unable  to 
accept  commands.  When  this  line  is  high,  the  DMA  sets  the  device  busy  bit  in 
its  status  word.  The  status  bit  is  reset  when  the  busy  line  is  lowered  by  the 
peripheral. 

The  error  code  control  line  is  used  by  the  peripheral  to  indicate  whether 
or  not  information  transmitted  from  the  peripheral  to  the  DMA  has  been  encoded. 

If  the  level  on  this  line  is  high,  the  four  least  significant  bits  of  each  of  the  two 
20-bit  half  words  are  concatenated  to  produce  the  eight  code  bits  transmitted  on 
the  internal  data  bus.  If  this  line  is  low,  the  DMA  ignores  the  four' least  signif- 
icant bits  in  each  of  the  two  20-bit  half  words  and  internally  generates  and  appends 
the  appropriate  code  bits.  ^ 

5.3.6  TIMING  MODULE 

The  BFTSC  contains  two  Timing  Modules,  each  of  which  includes  an  oscil- 
lator, countdown  chain  and  buffers,  dual  redundant  monitors,  and  interface  logic. 
The  configuration  of  the  Timing  subsystem  is  as  shown  in  Figure  5-21.  The 
output  of  each  Timing  Module  drives  a separate  Timing  bus. 

Both  Timing  Modules  are  powered  in  order  to  minimize  reconfigviration 
time  delays.  However,  only  one  Timing  Module  is  in  the  active  niode  at  any 
time.  The  second  module  serves  as  a standby  spare. 

The  active  Timing  Module  generates  three  coherent  timing  signals: 

a.  An  external  real-time  clock  (EXRTC). 

b.  A real-time  interrupt  (RTl)  every  8.  8064  niilliseconds.  It  is 
possible  to  increase  the  RTI  period  by  a factor  of  two  or  de- 
crease it  by  a factor  of  two  or  four  by  selecting  different  RTl 
taps.  ) 

c.  A system  timing  clock  (CLK)  at  a freqviency  of  1.  25  MHz.. 
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Timing  Subsystem  Functional  Block  Diagram 
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Dual-redundant  monitors  are  provided  for  each  timing  output  which  examine 
the  outputs  at  the  end  of  the  Timing  bus,  i.  e.  , where  the  bus  is  returned  to  the 
Timing  Module.  Each  of  these  monitors  uses  a status  line  to  announce  the  status 
of  its  associated  module  to  the  rest  of  the  BFTSC  system.  If  either  of  the  status 
lines  associated  with  the  active  module  should  indicate  an  out-of-tolerance  condi- 
tion while  the  spare  module  is  functioning  properly,  the  latter  raises  its  status 
lines  causing  all  BFTSC  modules  to  switch  over  to  it,  thus  reversing  the  roles 
of  the  active  and  spare  modules.  The  Timing  Modules  are  biased  such  that  when 
the  power  status  lines  become  valid.  Timing  Module  A raises  its  status  lines 
before  Timing  Module  B.  When  one  Timing  Modulo  lowers  its  status  lines  as  the 
result  of  a failure,  that  module  is  prevented,  by  a watchdog  timer,  from  raising 
its  status  lines  again  for  at  least  12  clock  pulses.  This  is  sufficient  time  for  the 
alternate  Timing  module  to  raise  its  status  lines. 

5.3.7  POWER  MODULE 

The  BFTSC  Power  Distribution  System  (cf.  Figure  5-22)  consists  of  two  re- 
dundant Power  Modules,  each  of  which  is  comprised  of  an  EMI/RFI-EMP  protec- 
tion network,  switch  assembly,  start-up  and  shut-down  control  circuitry,  and 
redundant  monitors  for  all  output  voltages.  Both  modules  use  the  regulated  out- 
puts from  a single  set  of  commercial  supplies  and  energy  storage  unit.  (In  the 
FTSC,  each  Power  Module  shall  have  its  own  regulators  and  energy  storage  unit 
and  shall  be  powered  by  a single  input  voltage  of  22-30  Vdc.  ) 

Each  output -voltage  monitor  is  dual-redundant  and  examines  the  voltages 
at  the  end  of  the  power  distribution  systeni  bus.  Each  of  these  monitors  uses  a 
status  line  to  announce  the  status  of  its  associated  module  to  the  rest  of  the 
BFTSC  system.  If  either  of  the  status  lines  associated  with  the  active  module 
should  indicate  an  out-of-tolerance  condition,  a switchover  to  the  alternate 
module  is  effected. 

r 

The  energy  storage  unit  provides  sufficient  energy  to  power  critical  circuits  1 

.f 

such  as  the  Hardened  Timer,  Circumvention  Systeni,  Tiniing  Module  oscillators, 
and  all  monitor  circuits  for  a period  of  60  milliseconds  after  the  power  con- 
ditioner outputs  have  gone  out  of  tolerance. 
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igure  5-22.  Power  Subsystem  Functional  Block  Diagram 
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5,3.8  CIRCUMVENTION  MODULI-: 

I • 

The  BFTSC  contains  three  Circumvention  Modules  acting  in  a triple- 
modular  redundant  configuration.  Each  Circumvention  Module  (cf.  Figure  5-23) 
has  a provision  for  accepting  inputs  from  a set  of  remote  radiation  detectors. 

The  Circumvention  Modules  each  provide  a "zero"  level  on  the  memory 
clamp  and  I/O  clamp  lines  under  any  of  the  following  conditions: 

a.  Neither  Power  Module  is  operating  within  tolerance; 

b.  Neither  Timing  Module  is  operating  within  tolerance; 

c.  The  radiation  level  exceeds  the  threshold  of  any  of  the  radiation 
detectors  associated  with  that  Circumvention  Module. 

In  addition,  each  Circumvention  Module  provides  a "zero"  level  circumvention 
signal  to  each  CCU  if  either  condition  1.  or  condition  3.  is  satisfied. 

The  memory  clamp,  l/O  clamp  and  the  CCU  circumvention  level  signals 
are  maintained  for  10  milliseconds  after  the  radiation  falls  below  the  threshold 
of  the  detectors  or  the  power  status  lines  return  to  the  "one"  level. 

5.  3.  HARDENED  TIMER 

The  BFTSC  contains  three  Hardened  Timers  operating  in  a triple-modular- 
redundant  configuration.  Each  Hardened  Timer  keeps  track  of  real  time  during 
circumvention,  power-down  and  reconfiguration  periods.  The  Hardened  Timer 
configuration  is  as  shown  in  Figure  5-24. 

A "zero"  level  on  any  two  of  the  I/O  clamp  signal  lines  from  the  three  Cir- 
cumvention Modules  activates  each  Hardened  Timer.  Each  Hardened  Timer  is 
also  activated  by  reconfiguration  mode  signals  front  any  two  of  the  three  CCUs. 

A downcount  hardened  timer  signal  front  the  CPU,  in  the  absence  of  any 
activation  signals,  causes  the  Hardened  Timer  to  cease  charging  the  capacitor 
and  to  begin  discharging  at  a rate  100  tintes  faster  than  the  charge  rate.  The 
RTI  output  flop  is  set  once  each  1/101  st  RTI  vintil  the  capacitor  is  contpletely 
discharged  or  until  it  is  reactivated.  The  Hardened  Tinter  is  able  to  record  an 
elapsed  tinte  of  up  to  at  least  six  seconds. 


dened  Timer  Module  Functional  Block  Diagram 
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SECTION  6 

FAULT  DETECTION  MECHANISMS 

The  BFTSC  contains  a distributed  set  of  hardware  monitors  for  the  purpose 
of  fault  detection  and  isolation*  The  hardware  monitors  operate  concurrently 
with  normal  system  operation  and  are  transparent  to  the  system  user.  All  hard- 
ware monitors  are  either  capable  of  being  tested  under  program  control  or  pro- 
vided redundantly  to  ensure  their  operation. 

6.  1 ADDRESS  AND  DATA  BUS  ERROR  CODE  MONITORS 

Address  and  data  are  each  accompanied  by  an  eight  bit  error  code  (cf.  Para- 
graph 5.  1.  1 and  5.  1.  2)  when  transmitted  by  a module  on  the  internal  address  or 
data  bus.  Each  CPU,  DMA,  SIU,  and  Memory  Module  has  an  address  and  data 
decoder  which  computes  the  error  code  for  each  word  transmitted  and  compares 
this  computed  code  to  the  code  received  with  the  word.  Any  address  or  data  code 
discrepancy  detected  by  a CPU,  DMA,  or  SIU  Module  is  reported  (along  with  its 
type)  directly  to  the  CCU.  A discrepancy  detected  by  a Memory  Module  causes 
that  module  to  inhibit  its  response  to  the  request,  resulting  in  a CPU  watchdog 
timer  alarm  (cf.  Section  6.  2). 

6.  2 CPU  WATCHDOG  TIMER 

Each  CPU  contains  a watchdog  timer  which  measures  the  time  interval 
between  the  instant  a device  (CPU,  DMA,  SIU)  is  given  access  to  the  bus  system 
by  the  bus  arbiter  and  the  instant  this  access  is  relinquished  by  the  device 
(cf.  Section  5.  1.  3).  If  access  has  not  been  relinquished  within  10  clock  periods, 
a watchdog  timer  alarm  fault  is  generated  and  reported  directly  to  the  CCU. 

6.  3 CPU  MONITOR 

The  monitor  CPU  performs  all  calculations  and  generates  all  outputs  in 
synchronism  with  the  active  CPU  but  does  not  transmit  its  outputs  on  the  internal 
buses  (with  the  exception  of  the  program  flags  and  the  monitor  fault  signal  which 
are  transmitted  to  the  CCU).  The  monitor  CPU  compares  all  of  its  outputs 
(except  program  flags  and  monitor  fault)  to  those  received  over  the  buses  from 
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the  active  CPU  and  reports  any  discrepancy  directly  (via  the  monitor  fault  signal) 
to  the  ecu.  The  monitor  CPU  also  contains  a monitor  mask  register  which  is 
used,  under  program  control  (cf.  Section  5.  3.  1),  to  invert  any  output  from 
the  monitor  CPU  for  the  purpose  of  testing  the  monitor  comparators. 

6.4  CPU  FLAG  MONITOR 

Each  ecu  receives  three  program  flag  inputs  from  each  CPU.  The  inputs 
from  the  monitor  CPU  are  compared  to  those  received  from  the  active  CPU  and 
any  discrepancy  is  reported  to  the  fault  decode  logic  within  the  CCU.  The  CCU 
also  monitors  the  program  flag  inputs  for  any  illegal  sequence  of  flags  (cf.  Section 

5.  3.  2)  and  reports  this  condition  to  the  fault  decode  logic  within  the  CCU. 

6.  5 ILLEGAL  OP  CODE  MONITOR 

Each  CPU  monitors  the  op  code  in  the  instruction  register  and  compares 
it  to  a prewired  maximum  assigned  op  code.  If  the  op  code  is  greater  than  the 
maximum,  an  illegal  op  code  interrupt  is  generated  within  the  CPU. 

6.  6 STOP  ADDRESS  MONITOR 

Each  DMA  and  SIU  Module  contains  a monitor  to  ensure  that  the  end-of- 
block  detectors  are  operating  correctly.  The  stop  address  is  stored  in  the  DMA 
and  SIU  along  with  its  error  code.  Three  comparators  (one  for  each  byte)  com- 
pare bits  0 to  7 of  the  address  counter,  bits  8 to  15  of  the  address  counter,  and 
the  error  code  associated  with  the  address  counter  to  the  corresponding  bits  in 
the  stop  address  register.  Since  the  error  code  is  capable  of  detecting  any  num- 
ber of  failures  within  a single  byte,  any  two  comparisons  are  sufficient  to  detect 
end-of-block  although  all  three  should  compare  at  this  time.  If  the  third  byte  does 
not  compare,  a failure  is  reported  to  the  CPU  via  the  DMA  or  SIU  general  inter- 
rupt and  a bit  in  the  DMA  or  SIU  status  register. 

6.7  BUS  ARBITER  WATCHDOG  TIMER 

Each  DMA  and  SIU  Module  contains  a watchdog  timer  which  measures  the 
time  interval  between  the  instant  it  requests  access  to  the  bus  system  and  the 
instant  that  access  is  granted.  If  access  has  not  been  granted  within  31  clock 
periods,  a failure  is  reported  to  the  CPU  via  the  DMA  or  SIU  general  interrupt 
and  a bit  in  the  DMA  or  SIU  status  register. 
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S CONTROL  WORD  MONITOR 

Kach  DMA  and  SIU  module  contains  a control  word  monitor  to  prevent  a 
block  from  being  initiated  or  a command  from  being  sent  while  a block  or  com- 
mand is  already  being  processed.  In  the  DMA,  the  monitor  also  ensures  that 
the  start  and  stop  bits  in  control  word  0 (cf.  Figure  S-20)  are  not  both  zeros  or 
both  ones.  If  the  control  word  monitor  detects  a failure,  it  is  reported  to  the 
CPU  via  the  DMA  or  SIU  general  interrupt  and  a bit  in  the  DMA  or  SIU  status 
register. 

6.  9 SERIAL  BUS  WAVEFORM  MONITOR 

Each  SIU  and  DIU  Model  continuously  monitors  the  serial  bus.  If  an 
invalid  waveform  is  detected  by  a waveform  monitor,  the  SIU  or  DIU  switches  to 
receive  on  the  alternate  bus.  The  SIU  reports  such  a failure  to  the  CPU  via  the 
SIU  general  interrupt  and  a bit  in  the  SIU  status  word.  Any  SIU  or  DIU  can  be 
commanded,  under  program  control  (cf.  Figures  5-14  and  5-18),  to  transmit  an 
invalid  waveform  in  order  to  test  the  monitors  in  the  next  module  on  the  bus. 

6.  10  SERIAL  BUS  ERROR  CODE  MONITOR 

Each  word  transmitted  on  the  serial  bus  is  followed  by  an  8-bit  error  code 
(the  same  code  as  that  used  on  the  internal  data  bus).  Each  SIU  and  DIU  com- 
putes the  error  code  for  each  word  as  it  is  shifted  in,  and  compares  this  code 
with  the  code  received  with  the  word.  Any  discrepancy  detected  by  a monitor, 
causes  that  module  to  switch  to  the  alternate  bus.  The  failure  is  reported  to  the 
CPU  via  the  SIU  general  interrupt  and  bits  in  the  SIU  status  word.  Any  SIU  or  DIU 
can  be  commanded,  under  program  control  (cf.  Figures  5-14  and  5-18),  to  trans- 
mit an  incorrect  error  code  in  order  to  test  the  monitors  in  the  following  modules 
on  the  bus. 

6.  1 1 SOFT  NAME  MONITOR 

Each  Memory  Module  has  two  independently  loadable  soft  name  r»'gisters, 
each  of  which  is  compared  to  the  received  address,  to  decode  the  module's  soft 
address.  If  the  outputs  of  the  two  decoders  do  not  agree,  the  soft  name  monitor 
inhibits  the  Memory  Module  from  responding  to  the  request  and  sets  a hit  in  the 
memory  status  word.  This  lack  of  response  causes  a watchdog  timer  fault  report 
from  the  CPU  to  the  CCU  (cf.  Section  6.  2).  The  soft  name  monitor  c.an  lie  tested 
by  loading  the  two  soft  name  registers  with  different  soft  names  (cf.  Table  S-t>) 
under  program  control. 
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6.  12  WRITE  PROTECT  MONITOR 

The  write  protect  monitor  in  each  Memory  Module  checks  the  address  with 
the  write  protect  register.  If  an  attempt  is  made  to  write  into  a write  protected 
quadrant  of  the  module,  the  monitor  sets  a bit  in  the  memory  status  word  and 
inhibits  response  to  the  request.  This  causes  a CPU  watchdog  timer  fault  report 
to  the  ecu.  The  write  protect  register  can  be  loaded  under  program  control 
(cf.  Table  5-6)  in  order  to  test  the  monitor. 

6.  1 3 ADDRESS  DECODE  MONITOR 

In  order  to  ensure  that  the  correct  word  select  line  has  been  enabled  once 
the  address  is  decoded,  the  address  decode  monitor  in  the  memory  senses  the 
word  select  line  and  computes  the  error  code  (6-bit  memory  code)  associated 
with  the  address  of  that  line.  This  code  is  compared  with  the  error  code  (con- 
verted from  8-bits  to  6-bits)  of  the  address  received  from  the  bus.  If  a dis- 
crepancy is  detected,  a bit  is  set  in  the  memory  status  word  and  memory  response 
is  inhibited  causing  a CPU  watchdog  timer  fault  report  to  the  CCU.  In  order  to 
test  this  monitor,  the  address  error  code  received  from  the  bus  (8-bits)  can  be 
forced  to  all  zeros  under  program  control  (cf.  Table  5-6). 

6.  14  MEMORY  DATA  ERROR  CODE  MONITOR 

The  memory  data  error  code  monitor  performs  two  comparisons  on  the 
data  read  from  or  written  to  the  memory.  The  error  code  from  the  system  bus 
encoder/decoder  (after  conversion  from  8-bits  to  6-bits)  and  the  error  code 
stored  with  the  data  in  memory  are  each  compared  to  an  independent  6 -bit  code 
computed  from  the  data.  (On  a write,  the  two  comparisons  are  identical.  ) Any 
discrepancy  sets  the  appropriate  bit(s)  in  the  memory  status  word  and  either 
inhibits  response  to  or  extends  the  acknowledgment  of  the  request  (depending 
upon  when  the  discrepancy  is  detected)  thereby  causing  a CPU  watchdog  timer 
fault  report  to  the  CCU.  The  memory  can  be  set  up,  under  program  control,  to 
accept  (and  store)  improperly  encoded  data  for  the  purpose  of  testing  the  error 
code  monitors. 


6-4 


d 


R A Y T H E O N C O M^A  N Y 

EOUIPMEIMT  DIVISION 

6.  15  SYNDROME  MONITOR 

When  a Memory  Module  is  in  the  error  correcting  mode  (cf.  Section 

5.  3.  3),  the  first  discrepancy  detected  between  the  computed  error  code  and  the 
code  stored  with  the  data  causes  the  syndrome  ("EXCLUSIVE  OR"  of  the  two 
codes)  to  be  saved  in  the  syndrome  register.  If  any  subsequent  error  code  dis- 
crepancy produces  a different  syndrome,  the  syndrome  monitor  sets  a bit  in  the 
memory  status  word  and  inhibits  response  to  the  request  which  causes  a CPU 
watchdog  timer  fault  report  to  the  CCU. 

6.  16  REFRESH  REQUEST  MONITOR 

When  a Memory  Module  is  in  the  self- refresh  mode  (cf.  Section  5.  3.  3), 
the  refresh  request  monitor  verifies  that  the  Memory  Module  is  alternately  read 
from  and  then  written  to.  If  two  successive  reads  or  writes  occur,  a bit  is  set 
in  the  memory  status  word  and  memory  response  is  inhibited  causing  a CPU 
watchdog  timer  fault  report  to  the  CCU. 

6.  17  RIPPLER  OVERFLOW  MONITOR 

Each  Memory  Module  has  a rippler  overflow  monitor  to  detect  when  an 
attempt  is  made  to  ripple  out  more  than  three  bits.  If  an  overflow  is  detected, 
a bit  is  set  in  the  memory  status  word  and  either  response  is  inhibited  or  acknowl- 
edgement is  extended  causing  a CPU  watchdog  timer  fault  report  to  the  CCU. 

6.  18  CHANNEL  SELECT  MONITOR 

Each  Plated  Wire  Memory  Module  is  constructed  using  four  stacks  or 
channels.  Selection  of  the  appropriate  channel  is  accomplished  through  the  use 
of  two  decoders  whose  outputs  are  compared  at  the  end  of  a loop  connecting  them 
to  their  destinations.  If  a discrepancy  in  the  two  decoder  outputs  is  detected,  a 
bit  is  set  in  the  memory  status  word  and  acknowledgement  is  extended  causing  a 
CPU  watchdog  timer  fault  report  to  the  CCU.  One  of  the  decoders  can  be  dis- 
abled under  program  control  for  the  purpose  of  testing  the  monitor. 

6.  19  X/Y  SWITCH  MONITOR 

Each  Plated  Wire  Memory  Module  uses  a matrix  technique  to  select  the 
word  to  be  accessed.  A word  is  selected  by  enabling  one  X switch  and  one  Y 
switch.  The  X/Y  switch  monitor  checks  the  switches  before  the  address  decode 
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is  t'nablod  to  onsvire  that  all  switches  are  off  and  after  the  address  decode  is 
enabled  to  ensure  that  both  an  X switch  and  a Y switch  are  on.  If  an  invalid 
condition  is  detected,  a bit  is  set  in  the  memory  status  word  and  acknowli-d^ement 
is  extended  causing  a CPU  watchdoj;  timer  fault  report  to  the  CCU,  The  monitor 
can  be  tested  by  invalidating  the  switch  sense  lines  under  program  control. 

6.  20  WORD  CURRENT  MONITOR 

Each  Plated  Wire  Memory  Module  contains  a word  current  monitor  which 
senses  the  current  through  the  X/Y  matrix.  If  no  current  is  detected  when  the 
word  current  is  enabled,  a bit  is  set  in  the  memory  status  word  and  acknowledge- 
ment is  extended  causing  a CPU  watchdog  timer  fault  report  to  the  CCU.  The 
word  current  can  be  inhibited  under  program  control  in  order  to  test  the  monitor. 

6.21  MEMORY  TIMING  PULSE  MONITOR 

Each  Plated  Wire  Memory  Module  contains  a timing  pulse  monitor  which 
verifies  that  all  of  the  required  timing  signals  occur  for  each  memory  cycle. 

If  a signal  is  missing,  a bit  is  set  in  the  memory  status  word  and  acknowledge- 
ment is  extended  causing  a CPU  watchdog  timer  fault  report  to  the  CCU.  Each  of 
the  timing  pulses  can  be  inhibited  under  program  control  in  order  to  test  the 
monitor. 

6.  22  TIMING  UUS  MONITOR 

The  system  clock,  real-tinie  interrupt,  and  timing  status  lines  from  each 
Timing  Module  are  routed  in  a loop  from  the  Timing  Module  to  each  module  which 
uses  them  and  then  back  to  the  Timing  Module.  There  are  dual- redundant  timing 
bus  monitors  in  each  Timing  Module,  each  of  which  controls  one  timing  status 
line.  If  a monitor  detects  an  out-of-tolerance  condition  on  any  of  the  received 
lines,  it  lowers  the  timing  status  line  associated  with  it  thus  reporting  the  fault 
directly  to  the  CCU. 

e.  2 3 POWER  BUS  MONITOR 

The  BFTSC  power  lines  and  power  status  lines  from  each  Power  Moduli' 
are  routed  in  a loop  from  the  Power  Module  to  each  module  which  uses  them  and 
then  back  to  the  Power  Module.  There  are  dual- redundant  power  bus  monitors 
in  each  Power  Module,  each  of  which  controls  one  power  status  line.  If  a monitor 
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detects  an  out-of-tolerance  condition  on  any  of  the  received  lines,  it  lowers  the 
power  status  line  associated  with  it.  The  Circumvention  Unit  monitors  the  power 
status  lines  and  reports  this  condition  directly  to  the  CCU. 

n.  24  RADIATION  DETECTORS 

Each  Circumvention  Module  accepts  inputs  from  a set  of  radiation  detectors 
(simulated  in  the  RFTSC)  distributed  throughout  the  systent.  When  a radiation 
event  is  detected,  the  Circumvention  Module  inhibits  all  I/O  and  memory  opera- 
tions and  reports  the  fault  directly  to  the  CCLi. 
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INSTRUCTION  SET  AND  DATA  FORMATS 


A.  1 DATA  FORMATS 
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The  BFTSC  data  formats  are  shown  in  Figure  A-1  and  consist  of  logical 
fixed-point  (integer),  and  floating-point  types.  There  is  no  checking  of  data 
types  during  execution.  The  instruction  operand  specifies  the  data  type  to  be 
used.  Hence,  if  a floating-point  add  instruction  is  executed,  the  data  will  be 
manipulated  as  floating-point  type  without  checking  the  type. 

A.  1 . 1 Immediate  Data  Format 

Immediate  data  words  are  used  as  operands  for  instructions  in  the 
immediate  mode  (cf.  Section  A.  3).  These  data  words  occupy  the  16  LSBs 
(bits  16-31)  of  the  instructions.  Bit  16  (the  sign  bit)  of  immediate  words 
is  extended  through  to  bit  0 to  produce  the  32 -bit  operands  used  in  the 
computations. 

A. 1.2  Logical  Data  Format 

Logical  data  words  consist  of  32  bits  (0-31),  which  are  treated  as 
unsigned  words  by  the  logical  instructions. 

A.  1 . 3 Fixed-Point  Format 

Fixed -point  numbers  are  represented  as  32-bit,  two' s -complement 
integers.  The  binary  point  is  located  to  the  right  of  the  LSB  (bit  31).  The 
range  of  integers  representable  is: 


A.  1.4  Floating-Point  Format  || 

Floating-point  numbers  are  represented  by  32-bit  words  consisting  of  a j,] 

^4-bit,  two  s complement,  fractional  mantissa  and  an  8-bit,  two^  s complement,  i i 

integer  exponent.  The  mantissa  occupies  the  upper  24-bits  of  the  word  (bits  0-23)  ij 

and  the  exponent  occupies  the  lower  8 bits  (24-31  ).  The  binary  point  for  the  j 

fractional  mantissa  is  to  the  right  of  the  sign  bit  (bit  0).  A normalized  floating  1 


0 1 31 

Fixed -point  numbers  (integers)  are  represented  in  a 32 -bit, 
two' s -complement  form. 


point  number  has  the  si^n  bit  of  the  mantissa  Oht  0)  different  froni  the  next  most 
si>;nificant  bit  (bit  1 ).  The  numeric  value  2e  ro  is  representetl  as  an  all- zero 
mantissa  and  a maxinium  ne^jative  exponent  floating-point 

instructions  assume  norntalized  inputs  and  produce  normalized  results. 


A.  2 INSTRUCTION  FORMAT 

The  BFTSC  utilizes  a single  instruction  format  with  capability  to  define 
vip  to  128  operation  codes  (op  codes).  Op  codes  00  hex  to  3F  hex  are  classed  as 
fetch-type  instructions  and  the  remaining  op  codes  (40  hex  to  7F  hex)  are  classed 
as  store-type  instructions.  The  instruction  format  is  shown  in  Figure  A-2. 


The  following  legend  is  used  throughout  this  appendix: 


op  code 
RB 
RA 
AM 

ADDRESS 

"b 

^b+n 

r 

a 

am 

a 

ea 

(X) 

X.  y 

X - y 

ex 

Wn 

PC 

OP 


Operation  Code 
Instruction  RB  Field 
Instruction  RA  Field 
Addressing  Mode  f'ield 
Instruction  Address  F'ield 
Register  specified  in  RB  F'ield 
r^^  4 n (modulo  8) 

Register  specified  in  RA  F'ield 

.‘\ddressing  Mode  specified  in  .-XM  F'ield 

Contents  of  .ADDRESS  F'ield 

Effective  address 

Contents  of  x 

X concatenated  with  y 

x is  replaced  by  y 

Extension  register 

Working  register  n 

F’rogram  Counter 

Operand 
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OP  CODE 

RB 

F 

0 6 

7 9 

10 

Field 

Bits 

OP  Code 

0 

0 

RB 

7 

- 9 

RA 

1 0 

- 12 

AM 

1 3 

- 15 

Address 

16 

- 31 

RA 


AM 


ADDRESS 


12  13  15  16  31 

Meaning 

Operation  code 

Specifies  one  of  8 source /destinatioxi 
rej^isters 

Specifies  one  of  8 source /destination / 
address  / index  registers 

Specifies  addressing  mode 

Specifies  a source  or  destination 
address 


Figure  A-2.  Instruction  Format 


A.  3 ADDRESSING  MODES 

The  "effective  address"  for  an  instruction  is  determined  by  combining 

the  contents  of  the  ADDRESS  field  and  the  register  specified  by  the  RA  field 

according  to  the  specified  address  mode  as  defined  in  Table  A-1.  For  fetch- 

type  instructions,  the  effective  address  specifies  the  source  of  one  of  the 

operands  for  the  instruction.  The  other  operand  (for  dyadic  instructions)  is 

contained  in  r.  . The  destination  for  the  result  is  r,  unless  otherwise 
b b 

specified  by  the  instruction.  For  store-type  instructions,  the  effective 

address  specifies  the  destination  for  the  result  or  the  location  of  the  next 

instruction  to  be  executed.  The  source  location  is  r,  unless  otherwise 

b 

specified  by  the  instruction. 

A.  3.  1 Direct  Modes 

Mode  0 - Register  to  register.  The  source  of  the  operand  for  fetch-type 

instructions  is  r . For  store -type  instructions,  the  result  is 
a 

placed  in  r (except  for  jump  instructions  for  which  r contains 
the  jump  address). 
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TABLE  A-1 
ADDRESS  MODES 


Mode 

Meaning 

Instruction 

Type 

Source /Destination 
Rules 

0 

Register  - Register 

Fetch 

OP  = (ea)  = (r  ) 

a 

1 

Immediate 

Fetch 

OP  = (ea)  = a 

2 

Direct 

Fetch 

OP  = (ea)  = (a) 

3 

Indirect 

Fetch 

OP  = (ea)  = ((a)) 

4 

Indexed,  Postincrement 

Fetch 

OP  = (ea)  = (a  + (r  )) 

cL 

r ■>-  r + I 
a a 

5 

Indexed,  Predecrement 

Fetch 

r r - 1 

a a 

OP  = (ea)  = (a  + (r^)) 

6 

Indexed 

Fetch 

OP  = (ea)  = (a  + (r  )) 

tX 

7 

Indexed,  Indirect 

Fetch 

OP  = (ea)  = ((a  + (r^))) 

0 

Register  - Register 

Store 

ea  = r 

a 

1 

Immediate 

Store 

ea  = a 

2 

Direct 

Store 

ea  = a 

3 

Indirect 

Store 

ea  = (a) 

4 

Indexed,  Postincrement 

Store 

ea  = a + (r  ) 

' a 

r ■»-  r + I 
a a 

5 

Indexed,  Predecrement 

Store 

r ■>  - r - 1 
a a 

ea  = a 4 (r  ) 
a 

6 

Indexed 

Store 

ea  = a 4 (r  ) 
a 

7 

Indexed,  Indirect 

Store 

ea  = (a  4 (r^)) 

t 
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Mode  1 


I, 

Mode  2 


Immediate.  For  fetch-type  instructions,  the  content  of  the 
ADDRESS  field  is  sign-extended  and  used  as  the  operand.  For 
store -type  instructions,  the  immediate  mode  is  the  same  as 
the  direct  mode  (mode  2). 

Direct.  The  ADDRESS  field  of  the  instruction  contains  the 
memory  address  which  is  the  source  of  the  operand  for 
fetch-type  instructions  or  the  destination  address  for  store - 
type  instructions. 


A.  3. 2 Indirect  Modes 

Mode  3 - Indirect  mode.  The  ADDRESS  field  of  the  instruction  contains 

the  memory  address  which  contains  the  source/destination 
address  for  the  instruction. 

Mode  7 - Indexed,  indirect.  (See  indexed  modes) 


A.  3.  3 Indexed  Modes 


Mode  4 


Indexed  with  (r,  ) postincremented.  The  content  of  the 

cL 

ADDRESS  field  of  the  instruction  is  added  to  the  content  of  r 

a 

to  produce  the  source/destination  address  for  the  instruction. 
After  the  address  is  computed,  the  content  of  r is  incremented 

Cl 

by  one. 

Indexed  with  (r  ) predecremented.  The  content  of  r is 
Si  ^ 

decremented  by  one  and  this  value  is  added  to  the  content  of 
the  ADDRESS  field  to  produce  the  source /destination  address 
for  the  instruction. 

Indexed  with  (r  ).  The  content  of  the  ADDRESS  field  is  added 
a 

to  the  content  of  r to  produce  the  source /destination  address 
for  the  instruction. 

Indexed,  indirect.  The  content  of  the  ADDRESS  field  is  added  to 
the  content  of  r^  to  produce  the  memory  address  which  contains 
the  source/destination  address  for  the  instruction. 
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I 8et  of  IM-  'l'St'.  instruction  nincnionics  alon^  with  their  definitions  and 
op  coties  is  list  ('ll  in  this  section. 

4.  1 I'etch- Type  Instructions 
.‘\.4.l.l  Load  Instructions 


Op  Code 

Mnemonic 

Def  inif  ion 

00 

I nu 

Load  He^'ister 

01 

1 OK 

Load  I'^xtension  Ke^jister 

02 

I nK2  I 

1 

0 t 

1 HIM 

1 Load  Multiple 

04 

LOH?  1 

IK 

i.ns2  1 

Load  C'otistant  Multiple 

2 i’ 

Lost  ) 

0'^ 

1 ON 

Load  Nej^ative  lntt'(;er 

0t( 

1 ONK 

Load  Nej’ative  Floating’ 

07 

l.OA 

1 oad  Ahsolvite  Value  Inti'ger 

08 

I.nAK 

Load  Ahsolut*'  VaUie  l'‘loatin^i 

0‘» 

Lix: 

Load  C'>n(''8  t’omplement 

OA 

LAO 

Load  .Active  f'nly 

OH 

1 MO 

1 o.ul  Monitor  tlnlv 

to 

LWO 

Load  Workinfj  Ri'n.  0 

tl 

1 W 1 

1 oad  Working  Reg.  1 

t2 

L\V2 

Load  Working  Reg.  2 

1 1 

1 w t 

1 oad  Working  Reg.  t 

.2  i''loatinjj 

;-l’oint  Arithmetic 

1 ns  t ruct  ions 

C^p  Code 

Mnemonic 

llefinit  ioi\ 

OC 

AnnF 

.Add  Floating 

on 

SUHK 

Suhtract  f loating 

OK 

M 1 >Y  I'" 

Mviltiply  Floating 

OF 

niVK 

nivide  Floating 

A- 7 


M nt*monic 


n«-finition 


Op  Cocio 


1 0 

SRI  F 

Sqviare  Root  F'loating 

1 1 

VADDF 

\’«'clor  Add  F'loating 

12 

VSUUF 

Vector  S»il)tract  l’li>a(ing 

13 

VMPYF 

Vector  MvUtiply  F'loaling 

14 

VIPF 

Vector  Inner  Product  Floating 

15 

VSMF 

Vector-Scalar  Multiply  F'loating 

lb 

CFX 

Convert  Floating  to  Integer 

17 

UPF 

Unpack  F'loating 

1 8 

PKF 

Pack  F’loating 

1.3  b'ixecl- I'^oint 

Integer  Arithmetic 

Instructions 

Op  Cod«' 

Mnemonic 

Description 

19 

ADD 

Add  Integer 

2R 

AGO 

Add  Integer  with  Carryout 

1 A 

SUB 

Subtract  Inti'g«‘r 

1 H 

MPY 

Multiply  Integer 

1C 

DIV 

Short  Dividend  Divide  Integt'r 

ID 

LDV 

i 

Long  Dividend  Divide  lnteg«>r  i 

1 f: 

CFL 

Convert  Integer  to  F'loating  | 

1.4  I.onical  Instructions 

' 

Op  Cock* 

Mnemonic 

Description  ] 

1 !•’ 

AND 

Logical  AND  ij 

20 

XOR 

Logical  F^xchisive  OR 

21 

lOR 

l-ogical  Inclusive  OR  'i 

■>  '> 

ANI 

Logical  AND  Inverted  tj 

A-H 


A.  4.  1.5  Shift/Rotate  Instructions 


Op  Code 

Mnemonic 

Description 

23 

ARS 

Arithmetic  Short  Shift 

24 

ARL 

Arithmetic  Lonjj  Shift 

25 

RRS 

Rotate  Short 

26 

RRL 

Rotate  Long 

27 

LRS 

Logical  Short  Shift 

28 

LRL 

Logical  Long  Shift 

A.  4. 1 . 6 Test 

and  Skip  Instructions 

Op  Code 

Mnemonic 

Description 

29 

OISN 

Logical  OR  Inverted  and  Skip  if 

Not  Ones 

2D 

OISO 

Logical  OR  Inverted  and  Skip  if 
Ones 

2A 

ASNZ 

Logical  AND  and  Skip  if  Not  Zeros 

2C 

ASZ 

Logical  AND  and  Skip  if  Zeros 

34 

CSNE 

Logical  COMPARE  and  Skip  if  Not 
Equal 

35 

CSEQ 

Logical  COMPARE  and  Skip  if 
Equal 

A.  4.  2 Store -Type  Instructions 

A.  4. 2 . 1 Store 

Instructions 

Op  Code 

Mnemonic 

Description 

40 

STR 

Store  Register 

41 

STE 

Store  Extension  Register 

42 

STD 

Store  Duplex 

47 

STZ 

Store  Zero 

43 

SZD 

Store  Zero  Duplex 

62 

STR2  1 

Store  Multiple  Single 

63 

STR3  j 

I 
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Mnemonic 


Op  Code 


STD2 

STD3 

STD7 

STH 

SPS 


SBPAl  ) 
SBPAO  j 
SBPDl  ) 
SBPDO  ( 
SWO 
SWl 
SW2 
SW3 


A.  4. 2. 2 Jump  Instructions 


Description 


Store  Multiple  Duplex 

Store  to  Hard  Address 

Store  Program  Counter  and 
Status  Single 

Store  Program  Counter  and 
Status  Duplex 

Store  with  Bad  Address 
Parity 

Store  with  Bad  Data 
Parity 

Store  Working  Register  0 
Store  Working  Register  1 
Store  Working  Register  2 
Store  Working  Register  3 


Code 

Mnemonic 

Description 

50 

IMP 

Jump 

4F 

JPZ 

Jump  if  Positive  or  Zero  Integer 

51 

JMI 

Jump  if  Negative  Integer 

52 

JZE 

Jump  if  Zero  Integer 

53 

JZEF 

Jump  if  Zero  Floating 

54 

JNZ 

Jump  if  Not  Zero  Integer 

55 

JNZF 

Jump  if  Not  Zero  Floating 

56 

JPS 

Jump  if  Positive  and  Not  Zero 
Integer 

57 

JPSF 

Jump  if  Positivt'  and  Not  Zero 
Floating 

58 

JMZ 

Jump  if  Negative  or  Zero  integer 

59 

JMZF 

Jump  if  Negative  or  Zero  Floating 

L 
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A.  4.2.3  Miscellaneous 


Op  Code 

Mnemonic 

Description 

5A 

JDN 

Decrement  r^^  Jump  if  Not  Zero 
Integer 

5C 

JOS 

Jump  if  Overflow  Set  and  Reset 
Overflow 

bD 

JCS 

Jump  if  Carryout  Set  and  Reset  Out 

SR 

JSB 

Jump  Subroutine 

Code 

Mnemonic 

Description 

5B 

DSI 

Disable  Interrupts 

5F 

ENI 

Finable  Interrupts 

60 

RFl 

Return  from  Interrupt 

64 

RET 

Return  from  Subroutine 

61 

XEC 

Execute 

A-l  I 
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A.  5 MACHINE  INSTRUCTIONS 

This  section  contains  a description  of  the  operation  of  each  of  the  BFTSC 
instructions  and  the  inputs  and  outputs  required. 

LOAD  REGISTER  LDR  (00) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^^)  (ea) 

The  contents  of  the  effective  address  are  loaded  into  the 
specified  register. 

LOAD  EXTENSION  REGISTER  LDE(Ol) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 
(ex) (ea) 

The  contents  of  the  effective  address  are  loaded  into  the 
extension  register. 

NOTES 

RB  is  unused  in  this  instruction. 
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I 

I 

LOAD  mui.tiplk: 

NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 

(r.  ) ' (ea)  1 

LDR 


(Tb^jMeafo) 

Two,  three  or  seven  data  words  are  loaded  ii^to  2,  .1  or  7 
successive  registers  starting  with  register  r.  (r  tollow  s r_.L 

O (»  ( 

NOTES 

When  iii\n^ediate  n^ode  (mode  1)  is  specified,  the  sign-*‘xtei»ded 
"a"  is  loaded  into  the  first  register.  The  remaii\ing  registers  are 
loaded  as  in  direct  n\ode  (n\ode  21  where  ea  + I = a -I  I . ea  f 2 - 
a + 2,  etc. 


LDR2  (02) 
LDR3  (03) 
LDR7  (04) 

0,  2-7 


I 1 

) LDR3  / 


V 


LDIL 
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EQUIPMENT  DIVISION 


LOAD  NEGATIVE  FLOATING  LDNF  (06) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

The  mantissa  is  two' s-complemented  and  the  number  is  normal- 
ized. 

ERROR  INDICATORS 


I 


|f 


Overflow  status  is  set  if  the  exponent  overflows  or  underflows 
during  normalization, 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  number  to  be  complemented. 
This  is  an  unnormalized  floating-point  number. 


RAYTHEON 
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I (JlllfMt  DIVISlOfX 

LOAD  ABSOLUTE  VALUE  INTEGER  L.DA  (07) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 


(r^^)  '-l(oa)l 

If  the  value  of  the  data  is  0 (sign  bit  set)  the  data  is  two's- 


compleniented  and  transferred  to  r^^. 


ERROR  INDICATORS 


Overflow  status  is  set  if  (ea)  = -2 


LOAD  ARSOLUTE  VALUE  FLOATING  LDAF  (08) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

(rj^)  1 (ea)| 

If  the  mantissa  of  the  effective  address  is  greater  ttian  zero, 
tlie  data  is  vmaffected.  If  t)ie  mantissa  is  less  tlian  zero,  it  is 
two's-conipleniented  and  tlien  normalized. 

ERROR  INDICATORS 

Overflow  status  is  set  if  tlie  exponent  overflows  or  underflows 
dviring  nornialization. 

NOTES 

When  inimediate  niode  (mode  1)  is  specified,  tlie  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an  unnormal- 
ized floating-point  number. 
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L.OAD  ONt:'S  COMPLKNtENT 

NORMAL  ADDRESS  MODE'S 
MACHINE  OPERATION 


LDC  (0^) 
0-7 


(r^^)  »-  (ea) 

The  contents  oi  the  ellective  address  are  one's-compleniented 
and  loaded  into  the  specified  rej;ister. 


LOAD  ACTIVE  ONLY  1.AO  (OA) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 
(r^)  * (ea) 

In  t)ie  active  CPU  only;  tlie  monitor  CPU  executes  tliis 
instruction  as  an  NOP  instruction. 


Ii 
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LOAD  MONITOR  ONLY  LMO  (OIM 

NORMAL  ADORKSS  MODES  0-7 

MACUlNt;  OPERATION 
«-  (ca) 

In  the  n\onitor  CPU  only;  the  active  CPU  executes  this 
instruction  as  an  NOP  instruction. 


LOAD  WORKING  REGISTER  LWO  (30) 

L\V  1 (31) 

L\V2  (32) 

L\V3  (33) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(WO),  (Wl),  (W2),  or(W3)»  (ea) 

Tiie  contents  of  tiie  effective  address  are  loaded  into  tlie 
specified  working  register. 

NOTES 


RH  is  unused  in  this  instrviction. 
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ADD  FLOATING  ADDF  (OC) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATOR 

(Tb)  ""(Tb)  + (ea) 

The  floating-point  content  of  the  effective  address  is  added  to 
the  floating-point  content  of  register  rb  and  the  result  is  placed  in 
rb*  Normalized  floating-point  results  are  generated. 

ERROR  INDICATORS 

Exponent  overflow  or  underflow  sets  overflow  status.  Mantissa 
overflow  is  internally  corrected  and  the  exponent  adjusted. 

NOTES 

When  Immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number. 
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SUBTRACT  FLOATING  SUBF  (OD) 

NORMAL  ADDRESS  MODES  0.  2-7 

MACHINE  OPERATION 

(Tb)  ^ (Tb)  - (ea) 

The  floating-point  content  of  the  effective  address  is  subtracted 
from  the  floating-point  content  of  register  rb*  The  result  is  placed 
in  rb*  Normalized  floating-point  results  ^re  generated. 

ERROR  INDICATORS 

Exponent  underflow  or  overflow  sets  overflow  status.  Mantissa 
overflow  or  underflow  is  internally  corrected. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number. 
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EtJUIPIWIENT  DIVISION 

MULTIPLY  FLOATING  MPYF  (OE) 

NORMAL  ADDRESS  MODES  0.  2-7 

MACHINE  OPERATION 

{r^)  *-Z4  MSB's  of  Mantissa  and  8-bit  exponent  of  (r^^)  x (ea). 

(ex)  <-23  LSB's  of  Mantissa  of  product  in  most  significant  23 
bits  followed  by  zeros. 

The  floating-point  content  of  r^^  is  multiplied  by  the  floating- 
point content  of  the  effective  address.  The  24  MSB's  of  the  resultant 
mantissa  and  the  8-bit  exponent  are  placed  in  r^^.  The  23  LSB's 
of  the  mantissa  followed  by  zeros  are  placed  in  ex.  Normalized 
floating-point  results  are  generated. 

ERROR  INDICATORS 

i 

Exponent  underflow  or  overflow  sets  overflow  status.  Mantissa  ' 

overflow  or  underflow  is  internally  corrected. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number. 
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DIVIDF!  FLOATING  DIVF  (OF) 

NORMAL  ADDRESS  MODES  0.  2-7 

MACHINE  OPERATION 

with  mantissa  truncated  after  24  bits, 

(ex)  Remainder  of  the  division.  Contains  the  remainder  sign 
bit  followed  by  the  23-bit  remainder  followed  by  zeros. 

The  floating-point  content  of  is  divided  by  the  floating-point 
content  of  the  effective  address.  The  quotient  (mantissa  truncated 
after  24  bits)  is  placed  in  rj^  and  the  remainder  is  placed  in  ex. 
Normalized  floating-point  results  are  generated. 

ERROR  INDICATORS 

Exponent  underflow  or  overflow  sets  overflow  status.  Divide 
by  zero  sets  divide  check  status. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
a is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number. 
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sail  ARK  ROOT  F [.GATING  SUTF(IO) 

NORMAL  ADDRESS  MODKS  0,  Z-7 

MACHINE  OPERATION 

(fjj)  * SORT  (ea)  with  mantissa  truncatfd  after  24  bits. 

The  floating-point  square  root  of  the  floatinji-point  content  of 
ea  is  placed  in  register  r^^.  No rm.« li/.ed  floating-point  results  are 
generated. 

ERROR  INDICATORS 

A negative  operand  sets  overflov  status. 

NOTES 

When  iiomediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number  and  will  produce  incorrect  results. 
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VECTOR  ADD  FLOATING 

NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


(r 

(r 


b+1 


b+2' 


-(rb^2)  + (ea  + 2) 


VADDF  (11) 
0.  2-7 


The  length  three  vector  of  operands  is  added  to  the  three 
specified  registers  (r^  follows  r^).  Normalized  floating-point 
results  are  generated. 

ERROR  INDICATORS 


Exponent  overflow  or  underflow  sets  overflow  status. 

NOTES 


When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  first  operand.  This  is  an  unnormalized  floating- 
point number.  The  second  and  third  operands  are  fetched  as  in 
direct  mode  (mode  2)  from  a + 1 and  a + 2. 


I 
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VECTOR  SUBTRACT  FLOATING 
NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


(^b)  *■  (^b)  - (ea) 
^^b+2^  ^^'b+z'  ” 


VSHRF  (12) 
0.  2-7 


The  length  three  vector  of  operands  is  svibtracted  from  the 
three  specified  registers  (r^  follows  r^).  Normalized  floating- 
point results  are  generated. 


ERROR  INDICATORS 


Exponent  overflow  or  underflow  sets  overflow  status. 


NOTES 


When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  first  operand.  This  is  an  unnormalized  floating- 
point number.  The  second  and  third  operands  are  fetched  as  in 
direct  mode  (mode  2)  from  a + 1 and  a + 2, 
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VECTOR  MULTIPLY  FLOATING 
NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


VMPYE  (13) 
0.  2-7 


The  length  three  vector  opernnd  is  element  by  clement  multi- 
plied by  the  specified  registers  (r,,  follows  r„).  Normaliy.ed 
floating-point  results  arc  generated. 


ERROR  INDICATORS 


Exponent  overflow  or  underflow  sets  overflow  statvis. 

NOTES 


When  inunediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  first  operand.  This  is  an  unnorma li/.ed  floating- 
point niunber.  The  second  and  third  operands  are  fetched  ns  in 
direct  mode  (mode  2)  from  a + 1 and  a + 2. 

In  the  first  two  multiplies  the  23  LSBs  of  tlic  mantissa  are 
destroyed.  In  the  third  multiply  tlie  23  LSDs  are  contained  in  the 
most  significant  23  bits  of  the  extension  register  followed  by 
all  zeros. 
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VKCTOR  INNER  PRODUCT  FLOATING  (POT  PRODllCT) 
NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 
(r^^)  ' (r^)  X (ea) 


VIDE  1 U) 
0.  2-7 


The  lenjitb  three  vector  operand  is  element  by  element  mnlti- 
plied  by  the  specified  registers  (r^  follows  r^),  and  the  sum  of  the 
products  is  put  in  the  last  register  (r.  ^ Nornializ.ed  floating- 

L)Ti- 

point  results  are  generated. 

ERROR  INDICATORS 


An  exponent  overflow  or  underflow  in  any  multiply  or  add 
sets  overflow  status. 

NOTES 

When  immediate  mode  (n\ode  1)  is  specified,  the  sign-extended 
"a”  is  used  as  the  first  operand.  This  is  an  unnorn^n  li/.ed  floating- 
point number.  The  second  and  third  operands  are  fetched  as  in 
direct  n\ode  (mode  2)  fron\  a t 1 and  a f 2. 

In  the  first  two  multiplies  tlie  23  l.SUs  of  the  mantissa  are 
destroyed.  In  the  third  multiply  the  23  l^iUs  are  contained  in 
the  most  significant  23  bits  of  tlie  extension  register  followed  by 
all  zeros. 
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VKCTOK-SCAl^K  MULTIPLY  Fl.OATlNC, 
NORMAL  ADDRKSS  MODKS 


VSMF  (15) 


MACHINE  OPERATION 
(Tb'  ' (I'b)  X (oa) 

^‘■b+z’'  ‘"b+z' 

Tlie  three  register  vector  coniponents  (r^  follows  r_,l  are 
multiplied  by  the  floa tiujj -point  scalar  content  of  the  ea.  Normalized 
floating-point  results  are  .kjenerated. 

ERROR  INDICATORS 


Exponent  overflow  or  underflow  sets  overflow  status, 


NOTES 


When  inin^ediate  mode  (mode  1)  is  specified,  the  sii;n-extended 
"a”  is  used  as  the  3Z-bit,  scalar  operand.  This  is  an  unnorn\a  li/etl 
floating; -point  number. 

hi  the  first  two  multiplies  the  Z3  LSBs  of  tlie  mantissa  are 
destroyed.  In  the  third  multiply  the  Z3  l,SHs  are  contained  in 
the  niost  significant  Z3  bits  of  the  extension  register  followed 
by  all  zeros. 
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CONVERT  FLOATING  TO  INTEGER  CFX(l6) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

(Tj^)  '■(ea)  converted  to  integer  format 

The  mantissa  of  the  content  of  the  ea  is  shifted  while  the 
exponent  is  adjusted  until  the  exponent  equals  31.  The  fractional 
part  of  the  number  is  truncated. 

ERROR  INDICATORS 

31  31 

Conversion  of  numbers  >2  -1  or<-2  sets  overflow 

status. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnormalized  number. 
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UNPACK  FLOATING  UPF(17) 

NORMAL  ADDRESS  MODES  U.  2-7 

MACHINE  OPERATION 

(Tj^)  ‘"Exponent  of  (ea)  (right  justified  with  sign  extension) 

*"  Mantissa  cf  (ea)  (left  justified  with  trailing  zeros) 

The  floating-point  content  of  the  effective  address  is  unpacked 
into  a mantissa  word  and  an  exponent  word  (Tq  follows  r^).  The 
24-bit  mantissa  is  left  justified  with  trailing  zeros  and  the  exponent 
is  right  justified  and  sign  extended. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  32-bit,  floating-point  operand.  This  is  an 
unnomialized  number. 
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PACK  FLOATING  PKFllS) 

NORMAL  ADDRESS  MOOES  0,  2-7 

MACHINE  OPERATION 

^24  MSB's  oi‘  normalized  mantissa  concatenated  with 
8 LSD's  of  adjusted  exponent. 

The  norn^alized  mantissa  and  adjusted  exponent  are  packed 

into  r,  . 
b 

For  mode  0 (register  to  register  mode),  tlie  exponent  is  (rj^) 
and  the  mantissa  to  be  nornialized  is  (r  ).  For  modes  2-7.  the 
exponent  is  (ea)  and  tlie  mantissa  is  (ea  + 1), 

ERROR  INDICATORS 

Exponent  underflow  sets  overflow  status. 

NOTES 

When  mmiediate  mode  (niode  1)  is  specified,  the  sign-extended 
"a"  is  used  as  the  exponent  operand.  The  mantissa  to  be  normalized 
is  fetched  as  in  direct  niode  (mode  2)  from  a + 1. 
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ADD  INTECEK  ADD  (19) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 
(Tb)  (Tb^  + 

The  integer  content  of  the  effective  address  is  added  to  the 
integer  content  of  register  rb.  and  the  result  is  put  into  rb* 

ERROR  INDICATORS 


I 

I 


Two' s-con^plenient  overflow  or  underflow  (reversed  sign) 
sets  overflow  status. 


Two' s-coniplement  carryout  sets  carryout  status. 


f 
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ADD  INTEGER  WITH  CARRYOUT  ACO  (2B) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(fb' 

(CO)*"new  carryout 

The  integer  content  of  tlie  effective  address,  tlie  integer  content 
of  register  rb*  and  tlie  content  of  the  carryout  status  flop  (0  or  1)  are 
added.  The  integer  result  is  put  into  rb  and  tlie  resultant  carryout  is 
put  into  the  carryout  status  flop. 

ERROR  INDICATORS 

A two' s -complement  overflow  or  underflow  sets  o\erflow 
status . 
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SUBTRACT  INTEGER 

NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


SUB  (lA) 
0-7 


(Tb) 

The  integer  content  of  the  effective  address  is  svibtracted  from 
the  integer  content  of  register  rb*  The  result  is  placed  in  rb* 

ERROR  INDICATORS 

Two' s-complenient  overflow  or  underflow  (reversed  sign) 
sets  overflow  status. 

Two' s-coniplenient  carryout  sets  carryout  status. 


MULTIPLY  INTEGER 


MPY  (IB) 
0-7 


NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 

(rb)  * 32  MSB's  of  (rb)  x (ea). 

(ex)  Sign  bit  of  tine  product  followed  by  31  LSB's  of  the  product. 

The  integer  content  of  register  rb  is  multiplied  by  the  integer 
content  of  the  effective  address.  The  63-bit,  integer  result  is 
packed  with  the  sign  bit  and  the  31  LSB's  in  rb  and  the  32  MSB's 
in  ex, 

ERROR  INDICATORS 

When  -2'  (80000000  hex)  is  multiplied  by  itself,  overflow 

statvis  is  set. 
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EQUIPMENT  DIVISION 

SHORT  DIVIDEND  DIVIDE  INTEGER  DIV  (1C) 

LONG  DIVIDEND  DIVIDE  INTEGER  LDV  (ID) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

For  DIV: 

(rfa)  -^(ea) 

(ex)  ♦■Remainder  of  the  division. 

The  integer  content  of  register  rj^  is  divided  by  the  integer  con 
tent  of  the  effective  address.  The  integer  quotient  is  placed  in  r^ 
and  the  remainder  is  placed  in  ex. 

For  LDV: 

(rfa)  ♦-  |(ex),  (r^^)j  -i-  (ea) 

(ex)  ♦■Remainder  of  the  division. 

The  63-bit,  integer  dividend,  produced  by  concatenating  the 
32-bit  integer  content  of  the  extension  register  with  the  31  LSB's 
of  register  r^,  is  divided  by  the  32-bit,  integer  content  of  the 
effective  address.  The  32-bit  integer  quotient  is  placed  in  r^ 
and  the  32-bit,  integer  remainder  is  placed  in  ex. 

ERROR  INDICATORS 

Divide  by  zero  sets  divide  check  status. 

Overflow  status  is  set  when  the  quotient  requires  more  than 
32  bits  including  sign. 


RAYTHEON 


CONVERT  INTEGER  TO  FLOATING  CEL  (IE) 


NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

*'(ea)  converted  to  floating-point  format. 

The  integer  content  of  the  effective  address  is  normalized  to 
form  the  mantissa  while  the  corrected  exponent  is  formed.  The 
result,  consisting  of  the  24-bit,  truncated  mantissa  concatenated 
with  the  8 -bit  exponent,  is  placed  in  rj^. 

LOGICAL  AND  AND  (IF) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

The  contents  of  register  r^^  are  ANDed  with  the  contents  of 
the  effective  address  and  the  result  placed  in  r^^. 

LOGICAL  EXCLUSIVE  OR  XOR  (20) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^)-(rj^)  e (ea) 

The  contents  of  r^^  are  EXCLUSIVE  ORed  with  the  contents  of 
the  effective  address  and  the  result  placed  in  r^^. 


r 
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LOGICAL  INCLUSIVE  OR  lOR  (21) 

NORMAL  ADDRP:SS  MODES  0-7 


MACHINE  OPERATION 

The  contents  of  register  r^^  are  INCLUSIVE  ORed  witli  the  con- 
tents of  the  effective  address  and  the  result  placed  in  r^^. 


LOGICAL  AND  INVERTED  ANI  (22) 

NORMAL  ADDRESS  MOPES  0-7 

MACHINE  OPERATION 
(Tfa)  ''  (Tjj)  A (ea) 

The  contents  of  register  rj^  are  ANDed  with  the  inverted  contents 
of  the  effective  address.  The  result  is  placed  in  r^. 
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ARITHMETIC  SHORT  SHIFT  ARS  (23) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^)  *-  shifted  left  if  (ea)  < 0;  right  if  (ea)  > 0 

The  content  of  register  r^  is  shifted  the  amount  specified  by 
the  least  significant  8 bits  of  the  content  of  ea.  A right  shift  causes 
sign  extension,  a left  shift  shifts  in  zeros. 

ERROR  INDICATORS 

If  the  sign  bit  changes  during  shifting,  overflow  status  is  set. 

NOTES 

The  two's -complement  shift  count  contained  in  the  lower  8 
bits  of  (ea)  is  used  (the  sign  bit  is  bit  24). 

ARITHMETIC  LONG  SHIFT  ARL  (24) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^),  (ex)  <-  shifted  | (r^,  (ex)  j ; left  if  (ea)  < 0;  right  if  (ea)  >0 

The  contents  of  the  register  r^  concatenated  with  the  lower  3 1 
bits  of  (ex)  are  shifted  the  amount  specified  by  the  least  significant  8 
bits  of  the  content  of  ea.  A right  shift  causes  sign  extension,  a left 
shift  shifts  in  zeros.  The  MSB  of  the  extension  register  (sign  bit) 
is  set  to  0. 

ERROR  INDICATORS 

If  the  sign  bit  of  (r^^)  changes  during  shifting,  overflow  status  is 

set. 

NOTES 

The  two' s -complement  shift  count  contained  in  the  lower  8 bits  of 
(ea)  is  used  (the  sign  bit  is  bit  24). 
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COMPANY 


ROTATE  SHORT  RRS  (25) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^)  '-rotated  (r^^);  left  if  (fa)<  0;  right  if  (ea)  - 0 

The  content  of  register  r^^  is  rotated  the  aniovmt  specified  by  the 
least  significant  8 bits  of  the  content  of  ea. 

NOTES 

The  two's-complement  shift  count  contained  in  the  lower  8 bits 
of  (ea)  is  used  (the  sign  bit  is  bit  24). 


ROTATE  LONG  RRL(26) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(Tjj).  (ex)  ♦-  rotated  [(Tj^).  (ex)j  ; left  if  (ea)  < 0;  right  if  (ea)  >0 

The  content  of  register  r^^  concatenated  with  the  content  of  the 
extension  register  are  rotated  the  amount  specified  by  the  least 
significant  8 bits  of  the  content  of  ea. 

NOTES 

The  two's-complement  shift  count  contained  in  the  lower  8 bits 
of  (ea)  is  used  (the  sign  bit  is  bit  24). 
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RAYTHEON  COMPA  N Y 

EOUIF>MENT  DIVISION 

LOGICAL  SHORT  SHIFT  LRS  (27) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(Tj^)  shifted  left  if  ea  < 0;  right  if  (ea)  > 0 

The  content  of  register  r^^  is  shifted  the  amount  specified  by  the 
least  significant  8 bits  of  the  content  of  ea.  Zeros  are  shifted  in. 

NOTES 

The  two's -complement  shift  count  contained  in  the  lower  8 bits 
of  (ea)  is  used  (the  sign  bit  is  bit  24). 

LOGICAL  LONG  SHIFT  LRL  (28) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

(r^),  (ex)  <- shifted  j (r^),  (ex)j  ; left  if  (ea)<  0;  right  if  (ea)  >0 

The  content  of  register  r^^  concatenated  with  the  content  of  the 
extension  register  is  shifted  the  amount  specified  by  the  least 
significant  8 bits  of  the  content  of  ea.  Zeros  are  shifted  in. 

NOTES 

The  two's-complement  shift  count  contained  in  the  lower  8 bits 
of  (ea)  is  used  (the  sign  bit  is  bit  24). 
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LOGICAL.  OK  LNVERTKD  AND  SKIP  IF  NOT  ONES  OISN  (29) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

Iflia)v(rj^)  i I's;  (PC)'  (PC)  f 1 

A logical  INCLUSIVE  OR  is  performed  on  the  inversion  of  (ea) 
and  (Tj^)  (not  altering  either  operand).  If  the  result  is  not  all  I's, 
the  content  of  PC  is  incremented  causing  an  instruction  to  be  skipped. 


LOGICAL  OR  INVERTED  AND  SKIP  IF  ONES  OlSO  (2D) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

If  (TI)  V {r^)  = I's;  (PC)^(PC)  + 1 

A logical  INCLUSIVE  OR  is  performed  on  the  inversion  of  (ea) 
and  (r^^)  (not  altering  either  operand).  If  the  result  is  all  I's,  the 
content  of  PC  is  incremented  causing  an  instruction  to  be  skipped. 


RAYTHEON 
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RAYTHEON  COMPA N Y 

EQUIPMENT  DIVISION 


LOGICAL  AND  AND  SKIP  IF  NOT  ZEROS  ASNZ  (2A) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 


If  (ea)  A (r^^)  i O's;  (PC)  ♦- (PC)  + 1 

A logical  AND  is  perfomicd  on  (ea)  and  (Tj^)  (not  altering  either 
operand).  If  the  result  is  not  all  O's,  the  content  of  PC  is  incremented 
causing  an  instruction  to  be  skipped. 


LOGICAL  AND  AND  SKIP  IF  ZEROS  ASZ  (2C) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

If  (ea)  A (r^)  = O's;  (PC)  (PC)  + 1 

A logical  AND  is  performed  on  (ea)  and  (r^^)  (not  altering  either 
operand).  If  the  result  is  all  O's,  the  content  of  PC  is  incremented 
causing  an  instruction  to  be  skipped. 
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LOGICAL  COMPARE  AND  SKIP  OF  NOT  EQUAL  CSNE  (34) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

If  (ea)  / (rj^);  (PC)  *-  (PC)  + 1 

A logical  EXCLUSIVE  OR  is  performed  on  (ea)  and  (r^^)  (not 
altering  either  operand).  If  the  result  is  not  all  O's,  the  content  of 
PC  is  incremented  causing  an  instruction  to  be  skipped. 


LOGICAL  COMPARE  AND  SKIP  IF  EQUAL  CSEQ  (35) 

NORMAL  ADDRESS  MODES  0-7 

MACHINE  OPERATION 

If  (ea)  = (rj^):  (PC)  ^ (PC)  + 1 

A logical  EXCLUSIVE  OR  is  performed  on  (ea)  and  (r^^)  (not 
altering  either  operand).  If  the  result  is  all  O's,  the  content  of 
PC  is  incremented  causing  an  instruction  to  be  skipped. 


RAYTHEON  COMPANY 

EQUIPMENT  DIVISION 


STORE  REGISTER  STR  (40) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 
(ea) (r^) 

The  contents  of  the  specified  register  are  stored  into  the 
effective  address. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

STORE  EXTENSION  REGISTER  STE(41) 

NORMAL  ADDRESS  MODES  0.  2-7 

MACHINE  OPERATION 
(ea)  (ex) 

The  contents  of  the  extension  register  are  stored  into  the 
effective  address. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 


RB  is  unused  in  this  instruction. 
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STORE  DUPLEX 


NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


STD  (42) 


(ea)  <-  (t^) 


(ea  + 4096)  (r^^) 

The  contents  of  the  specified  register  are  stored  into  ea  in 
one  memory  block  and  also  into  ea  + 4096  in  the  following  memory 
block. 


NOTES 


When  register  to  register  mode  (mode  0)  is  specified,  an  NOP 
instruction  is  performed. 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 


STORE  ZERO 


NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 
(ea)  ♦"O’s 


STZ  (47) 
0,  2-7 


All  zeros  are  stored  into  the  effective  address. 


NOTES 


When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  this  instruction. 
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RAYTHEON  COMPA  N Y 

EQUIP’VIENT  DIVISION 

STORE  ZERO  DUPLEX  SZD  (43) 

NORMAL  ADDRESS  MODES  2-7 

MACHINE  OPERATION 
(ea) ^ 0’ s 
(ea  + 4096)  O's 

All  zeros  are  stored  into  ea  in  one  niemory  block  and  also 
into  ea  + 4096  in  the  following  memory  block, 

NOTES 

When  register  to  register  mode  (mode  0)  is  specified,  an 
NOP  instruction  is  performed. 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  this  instruction. 
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STORE  MULTIPLE  SINGLE 


NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


STR2  (62) 
STR3  (63) 

0,  2-7 


(ea)  (r^) 
(ea+l)*-(r^^j) 

(ea+2)^ 


STR2 


STR3 


The  contents  of  2 or  3 registers  starting  with  r^  (rQ  follows  r^) 
are  stored  into  2 or  3 successive  addresses  starting  with  ea. 


NOTES 


When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 
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STORK  MULTIPLE  DUPLEX 


STDZ  (44) 
STD3  (45) 
STD?  (46) 


NORMAL  ADDRESS  MODES 
MACHINE  OPERATION 


0,  2-7 


(ea)  »-  (r^) 


(ea  + 4096)  *"  (r^^) 


^STD2 


(ea  + 1) 


(ea  + 4096  + I) 


(ea  + 4096  + 2) 


STD3 


(ea  + 6)-(r^^.) 


(ea  + 4096  + b)  *-  {r.  , . ) 

b+b 


y STD' 


The  contents  of  2,  3 or  7 re^jisters  starting  with  r^  (r^  follows 
r^)  are  stored  into  2,  3 or  7 successive  pairs  of  memory  addresses 
starting  witli  ea  in  one  memory  block  and  ea  + 4096  in  tlie  following 
memory  block. 


notf:s 


When  register  to  register  mode  (niode  0)  is  specified,  an  NOP 
iiistruction  is  performed. 


When  immediate  mode  (mode  1)  is  specified,  tlie  instruction 
is  executed  as  though  direct  mode  (niode  2)  were  specified. 


I i 
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STOKl-:  TO  HARP  APPUKSS  STl  1 (-49) 

NORMAL  AOLRKSS  MOlUvS  Z.7 

MACMINK  OPERATION 

1 lie  hard  address  control  function  specified  l)y  the  effective 
address  is  performed. 

This  instruction  stores  to  the  effective  address  in  the  hard 
address  spectrum  by  placing’  ea  onto  the  address  bus  and  onto  the 
16  MvSRs  of  the  data  bus.  Tlie  si^n  bit  of  ea  (same  as  data  bit  0) 
is  placed  onto  the  16  LSUs  of  the  data  bus  and  the  hard  address 
control  line  is  enabled. 

NOTES 

When  register  to  register  mode  (mode  0)  or  immediate  moiR 
(mode  1)  is  specified,  the  instruction  is  executed  as  tliou>;h  direct 
mode  (mode  2)  were  specified. 

UR  is  not  used  in  tliis  instruction. 
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STORE  PC  & STATUS  SINGLE  SPS  (48) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 


(ea)  '■  (status),  (PC) 

The  contents  of  the  status  register  concatenated  with  the  content 
of  PC  are  stored  into  the  effective  address.  The  status  register 
contains  interrupt  disable,  divide  check,  overflow,  illegal  op  code, 
and  carryout  status,  and  the  level  of  tine  higlnest  priority  pending 
interrupt. 
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NOTES 

Wlien  ininnediate  nnode  (nnodc  I)  is  specified,  the  instruction 
is  executed  as  thougln  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  tlnis  instruction. 

Bit  7 is  not  used.  It  is  present  only  so  tlnat  tine  active  and 
nnonitor  CPUs  Inave  the  information. 
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STORK  PC  & STATUS  DUPLEX  SPc:  (4 A) 

NORMA  I.  ADDRESS  MODES  2-7 

MACHINE  OPERATION 

(ea)  (status),  (PC) 

(ea  + 4096)  (status),  (PC) 

The  contents  of  the  status  register  concatenated  with  the  content 
of  PC  are  stored  into  ea  in  one  memory  block  and  also  into  ea  + 4096 
in  the  following  men^ory  block.  The  status  register  contains  interrupt 
disable,  divide  check,  overflow,  illegal  op  code,  and  carryout  status, 
and  the  level  of  the  highest  priority  pending  interrupt. 
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NOTES 

When  register  to  register  mode  (niode  0)  is  specified,  an  NOP 
instrviction  is  performed. 

When  inimediate  mode  (mode  1)  is  specified,  tiie  instrviction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 

RD  is  not  used  in  this  instruction. 

Bit  7 is  not  used.  It  is  present  only  so  that  the  active  and 
monitor  CPUs  liave  the  same  information. 
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STORE  WITH  BAD  ADDRESS  PARITY  SBPAl  (4B) 

SBPAO  (4C) 

NORMAL  ADDRESS  MODES  2-7 

MACHINE  OPERATION 

(ea)  (rjj) 

The  contents  of  the  specified  register  are  stored  into  the 
effective  address.  The  8 parity  bits  appended  to  the  address  on  the 
address  bus  are,  for  these  instructions,  generated  by  the  instruc- 
tion as  all  ones  (SBPAl)  or  all  zeros  (SBPAO)  instead  of  the  proper 
parity. 

NOTES 

When  register  to  register  mode  (mode  0)  is  specified,  a normal 
register  to  register  store  takes  place;  address  parity  is  not  gen- 
erated. 

When  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 


A- 51 


Li 


RAYTHEON 


RAYTHEON  COMPANY 

t(juiPN/iENT  Division 


STORE  WITH  BAD  DATA  PARITY  SBPDl  (4D) 

SBPDO  (4E) 

NORMAL  ADDRESS  MODES  2-7 

MACHINE  OPERATION 

(ea)  <- 

The  contents  of  the  specified  register  are  stored  into  the 
effective  address.  The  8 parity  bits  appended  to  the  data  on  the 
data  bus  are,  for  these  instructions,  generated  by  the  instruction  as 
all  ones  (SBPDl)  or  all  zeros  (SBPDO)  instead  of  the  proper  parity. 

NOTES 

When  register  to  register  mode  (mode  0)  is  specified,  a normal 
register  to  register  store  takes  place;  data  parity  is  not  generated. 

When  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 
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STORE  WORKING  REGISTER  SWO  (65) 

SW  1 (66) 

SW2  (67) 

SW3  (68) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

(ea)«-(W0),  (Wl).  (W2),  or  (W3) 

The  contents  of  the  specified  workinjj  rejiister  are  stored  into 
the  effective  address. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  tlie  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  this  instruction. 


■I  LIMP  JMP(50) 

NORMAL  ADDRESS  MODES  0.  2-7 

MACHINE  OPERATION 

(PC)  ea  for  modes  2-7 
(PC)  (r  ) for  mode  0 

Tlie  content  of  PC  is  replaced  by  ca  for  modes  2-7,  by  (r  ) 

3 

for  mode  0. 

NOTES 

Wlien  imnAediate  niode  (niode  1)  is  specified,  tbe  instruction  is 
execvited  as  tliough  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  tliis  instruction. 
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JUMP  IF  POSITIVE  OR  ZERO  INTEGER 
NORMAL  ADDRESS  MODES 


MACHINE  OPERATION 


If  0,  (PC)  ea  for  modes  2-7 

(PC)«-(r  ) for  inode  0 
a 


JPZ  (4F) 
0.  2-7 


If  the  content  of  the  specified  register  is  positive  or  zero,  the 

content  of  PC  is  replaced  by  ea  for  modes  2-7,  by  (r  ) for  mode  0 

a 


NOTES 


When  UTimediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 


JUMP  IE  negative:  integer 
NORMAL  ADDRESS  MODES 


MACHINE  OPERATION 


JMI  (51) 
0,  2-7 


ff  (PC)  »"ea  for  modes  2-7 

(PC)  *"(r  ) for  mode  0 

3 


If  the  content  of  the  specified  register  is  negative,  the  content 
of  PC  is  replaced  by  ea  for  modes  2-7,  by  (r  ) for  mode  0. 


NOTES 


W'hen  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 
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JUMP  IF  ZERO  INTEGER 
JUMP  IF  ZERO  FLOATING 


NORMAL  ADDRESS  MODES 


MACHINE  OPERATION 


JZE  (52) 
JZEF  (53) 

0.  2-7 


If  (Tj^)  = 0,  (PC)  *- ea  for  modes  2-7 
(PC)*-(r  ) for  mode  0 

Si 

If  the  content  of  the  specified  register  is  zero,  the  content  of 
PC  is  replaced  by  ea  for  modes  2-7.  by  (r  ) for  mode  0. 

Si 


NOTES 


When  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 


JUMP  IF  NOT  ZERO  INTEGER 
JUMP  IF  NOT  ZERO  FLOATING 


NORMAL  ADDRESS  MODES 


MACHINE  OPERATION 


JNZ  (54) 
JNZF  (55) 

0.  2-7 


If  (r^^)  i 0,  (PC)  ♦-  ea  for  modes  2-7 
(PC)  ♦"(r  ) for  mode  0 

A 

If  the  content  of  the  specified  register  is  not  zero,  the  content 
of  PC  is  replaced  by  ea  for  modes  2-7,  by  (r  ) for  mode  0. 

Si 


NOTES 


Wlien  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  thovigh  direct  mode  (mode  2)  were  specified. 
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1^  <J  I »■  M ( M T DIVISION 

JUMP  IF  POSITIVE  AND  NOT  ZERO  INTEGER  J PS  (56) 

JUMP  IF  POSITIVE  AND  NOT  ZERO  FLOATING  J PSP  (67) 

NORMAL  ADDRESS  MODES  C.  2.-1 

MACHINE  OPERATION 

If  ^0.  (PC)  *"  ea  for  modes  2-7 
(PC)  ♦"(r  ) for  mode  0 

If  the  content  of  the  specified  register  is  positive  and  not  zero, 

tlie  content  of  PC  is  replaced  by  ea  for  modes  2-7,  by  (r  ) for  iiTode 

a 

0. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 


JUMP  IF  NEGATIVE  OR  ZERO  INTEGER  JMZ  (58) 

JUMP  IF  NEGATIVE  OR  ZERO  FLOATING  JMZF  (59) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

If  * 0.  (PC) ea  for  modes  2-7 

(PC)e  (r  ) for  mode  0 
a 

If  the  content  of  the  specified  register  is  negative  or  zero,  the 

content  of  PC  is  replaced  by  ea  for  modes  2-7.  by  (r  ) for  nmde  0. 

a 

NOTES  i| 

ij 

When  immediate  mode  (mode  1)  is  specified,  the  instruction  ;} 

is  executed  as  though  direct  mode  (mode  2)  were  specified. 

, s 

y 


RAYTHEON  COMPANY 
^ XrAYTHEONJ 

CIJUIPMENT  OlVISlON 

DECRP:MENT  (rn),  jump  if  not  zero  integer  jDN  (5A) 

NORMAL  ADDRESS  MODES  0.  Z-7 

MACHINE  OPERATION 

Initially  (r^^)  «-  (r^^)  - 1 

Then  if  (r^)  ^ 0,  (PC)  » ea  for  n^odes  Z-7 
(PC)  (r  ) for  mode  0 

The  content  of  the  specified  register  is  decremented  by  one. 

If  the  result  is  not  zero,  the  content  of  PC  is  replaced  by  ea  for 
modes  Z-7.  by  (r  ) for  mode  0. 

NOTES 

When  uimiediate  mode  (mode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  Z)  were  specified. 


JUMP  IF  OVERFLOW  SET  AND  RESET  OVERFLOW'  JOS  (5C) 

NORMAL  ADDRESS  MODES  0 Z-7 

MACHINE  OPERATION 

If  (OV  ) = 1 . (PC)  ea  for  modes  Z-7 
(PC)'~  for  mode  0 

(OV) 0 

If  the  overflow  statvis  flop  is  set.  the  content  of  PC  is  replaced 

by  ea  for  modes  Z-7.  by  (r^)  for  mode  0.  The  overflow  status  flop 
is  then  reset. 

NOTES 

When  iiiMi^ediate  mode  (mode  1)  is  specified,  the  instruction  is 
execvited  as  though  direct  mode  (mode  Z)  were  specified. 

RB  is  not  used  in  this  instruction. 
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JUMP  IF  CARRYOUT  SET  AND  RESET  CARRYOUT  JCS  (50) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

If  (CO)  = 1,  (PC)  ea  for  modes  2-7 
(PC)'"  (r  ) for  mode  0 

(CO)-O 

If  the  carryout  status  flop  is  set,  the  content  of  PC  is  replaced 

by  ea  for  modes  2-7,  by  (r  ) for  mode  0.  The  carryout  status  flop 

£1 

is  then  reset. 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  this  instrxjction. 
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-lUMP  SUHROUTLNK  .ISU(51':) 

N(  )|<  MA  L ADDU  I ISS  NH)|)I  ;S  O,  /-  / 

MACHINE  OPERATION 


[r^)  ' (status),  (PC) 

(PC)  ea  for  modes  2-7 
(PC)»-  (r  ) for  mode  0 

The  contents  of  the  status  register  concatenated  with  the  content 
of  PC  are  stored  into  the  specified  register.  Then  the  content  of 
PC  is  replaced  by  ea  for  modes  2-7,  by  (r  ) for  mode  0.  The  status 

cl 

register  contains  interrupt  disable,  divide  check,  overflow,  illegal 
OP  CODE,  and  carryout  status,  and  the  level  of  the  highest  priority 
pending  interrupt. 
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INTERR 

DISABL 
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U 

0000000 

INTERRUPT 

LEVEL 

PC 

0 6 7 8 9 10  11  12  13  15  16  31 

(STATUS),  (PC) 


NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

Bit  7 is  not  used.  It  is  present  only  so  that  the  active  and 
monitor  CPUs  have  the  same  information. 
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DISABl.r  INTERRUPTS  DSI  (5B) 

L'NADLK  INTERRUPTS  ENI  (5F) 

NORMAL  ADDRESS  MODES  None  Used 

MACHINE  OPERATION 

Interrupts  are  disabled  (DSI) 

or 

Interrupts  are  enabled  (ENI) 

NOTES 


All  fields  except  the  OP  CODE  are  unused. 
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t ij  l)  I (■  N/l  f N I t)  I V I S I O M 

KKTl'RN  FROM  LNT KU lU' PT  Rl'l  ((.0) 

i RETURN  FROM  SUBROUTINE  RET  (64) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

(status),  (PC) (ea) 

The  contents  of  the  interrupt  disable,  divide  check,  overflow, 
illegal  OP  CODE,  and  carryout  status  flops  are  replaced  by  (ea) 
bits  8-12.  The  content  of  PC  is  replaced  by  (ea)  bits  16-31.  For 
RFl,  the  in-process  flop  for  the  interrupt  level  specified  by  (ea) 
bits  13-15  is  reset.  For  RET,  the  in-process  flop  is  not  reset. 
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0000000 


INTERRUPT 

LEVEL 

PC 

9 

10 
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12 

13  15  16  31 

(ea) 


NOTES 

When  immediate  mode  (niode  1)  is  specified,  the  instruction  is 
executed  as  though  direct  mode  (mode  2)  were  specified. 

RB  is  not  used  in  this  instruction. 
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EXECUTE  XEC  (61) 

NORMAL  ADDRESS  MODES  0,  2-7 

MACHINE  OPERATION 

The  instruction  contained  in  the  effective  address  is  executed. 

This  instruction  does  not  alter  PC  in  order  to  fetch  the  instruc- 
tion in  ea.  PC  is  altered  only  if  the  instruction  in  ea  causes  PC  to 
change  (i.  e.  , jun^p). 

NOTES 

When  immediate  mode  (mode  1)  is  specified,  the  instruction 
is  executed  as  though  direct  mode  (mode  2)  were  specified. 

If  an  interrupt  occurs  before  the  content  of  ea  is  fetched,  tlie 
EXECllTE  instruction  is  restarted  upon  return  from  the  interrupt. 
Any  register  modified  by  the  housekeeping  (mode  4 or  5)  for  the 
previous  fetch  (before  the  interrupt)  of  this  instruction  is  not 
reinitialized. 

RB  is  not  used  in  this  instruction. 
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EQUIPMENT 


Division 


Active  CPU 

Alexic  State 

Amnestic  State 

Bus  Arbiter 

Bus  State 

CAT  I,  II,  III,  and  IV 
Faults 


One  of  the  two  powered  CPUs;  provides  its  out- 
puts to  the  other  modules  and  controls  the 
computer. 

State  in  which  all  volatile  storage  and  configvira- 
tion  status  information  is  assumed  to  be  lost 
(e.  g.  , following  a power  interruption). 

State  in  which  all  information  is  assumed  to  be 
lost  (e.  g.  , cold  start). 

The  portion  of  the  CPU  which  exercises  admin- 
istrative control  over  access  to  the  address, 
data,  and  control  buses. 

The  specific  set  of  three  address-bus  bytes  and 
five  data-bus  bytes  which  are  active  at  any  given 
time. 

Category  I,  II,  III,  and  IV  Faults  (see  Fault 
Category). 


Coverage  - The  conditional  probability  that  the  system 

recovers  from  a fault  given  that  sufficient  oper- 
ational hardware  is  available. 


A signal  from  each  Circumvention  Module  to 
the  ecu  Modules  indicating  a radiation  event 
or  a power  switchover. 

The  inhibition  of  all  I/O  and  memory  operations 
during  a radiation  event  or  a power  interruption. 

The  specific  pair  of  CPUs  assigned  to  the  active 
and  monitor  CPU  roles  at  any  given  time. 

A pair  of  identical  elements  assigned  to  the 
same  function,  either  one  of  which  can  assume 
the  active  role  with  the  other  serving  as  a 
spare. 

A function  of  each  Power  Module;  provides 
sufficient  energy  to  power  critical  circuits 
during  the  time  required  for  a power  switchover 
to  the  standby  Power  Module  or  a radiation 
event. 
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Error  Codes 


! 

i 


Error  Correction 


Fault  Category 


Fault  Interrupt 


Fault  Tolerance 


Flags  1,  2,  and  3 


Frame  Sync 


Hard  Addresses 


Two  shortened  cyclic  codes  used  to  protect 
information  within  the  BFTSC.  The  bus  code  < 

is  used  to  protect  all  addresses  and  data  passed 
among  BFTSC  modules  and  over  the  serial  bus; 
it  is  defined  by  the  ^nerator  polynomial 
g(x)  = (x^  + X + 1)  (3^  + X + 1).  The  memory 
code  is  used  to  protect  all  information  stored 
in  main  memory;  it  is  defined  by  the  generator 
polynomial  g'(x)  = x^  + x + 1.  (Same  as  Parity 
for  FTSC.  ) 

A function  of  each  Memory  Module;  when  in  tlie 
error  correction  mode,  a Memory  Module 
examines  each  word  read  and  alters  any  single 
incorrect  bit  to  produce  a properly  encoded  j 

word.  ' 

Any  one  of  the  four  categories  into  which  faults  i 

in  the  BFTSC  are  classified;  viz;  power  inter-  i 

ruptions  or  radiation  events  (Category  I),  CPU  I 

faults  (Category  II),  address  or  data  bus  faults  ; 

(Category  III),  and  I/O  module,  watchdog  i 

timer,  or  Timing  Module  faults  (Category  IV). 

A signal  from  each  CCU  module  indicating  that 
a fault  has  been  reported  by  one  or  more  of  the 
fault  monitors  within  the  BFTSC.  . 

The  ability  to  tolerate  faults;  i.  e.  , to  retain 

operational  capability  in  the  presence  of  | 

failures.  ! 

Three  discrete  signals  set  or  reset  by  the  CCU 

in  response  to  information  received  from  the 

CPUs.  1 

One  of  four  patterns  of  pulses  transmitted  on  1 

the  serial  data  bus.  It  consists  of  three  posi- 
tive  pulses  followed  by  three  negative  pulses 
and  precedes  the  first  word  in  every  frame. 

Those  addresses  assigned  uniquely  by  physical 

location  to  the  Memory,  DMA.  and  Sll'  Modules  r 

and  to  which  those  modules  respond  in  the  hard 

address  mode. 
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Hard  Address  Mode 

Hardware  Status  Words 
I and  Z 

I/O  Clamp 

Interrupt  Mask 

Men^ory  Clamp 

Monitor 

Monitor  CPI' 

Monitor  Mask 

NDRO 

Non-Volatile 

Normal  Mode 

Pa  rity 


One  ot  the  two  addressing;  modes  in  the 
Hk  TSC;  used  for  reconfiguration  and  test 
purposes. 

Two  words,  accessible  under  program  con- 
trol, which  contain  information  concerning  the 
Bk'TSC's  current  configuration, 

A signal  from  each  Circumvention  Module  to 
all  I/O  modules  whicli  inliihits  all  I/O  during 
a radiation  event  or  power  switchover. 

A set  of  signals  in  each  C'Pl',  set  or  reset 
under  program  control,  each  of  which  inhibits 
a different  interrupt  from  being  detected  by 
the  CPl', 

A signal  from  each  Circumvention  N'odule  to 
all  Memory  Modules  which  inhibits  memory 
operation  during  a radiation  even  or  power 
switchover, 

A device  used  to  verify  the  opei  a 

specific  function. 

One  of  the  two  powered  CPUs;  ver.  ies  the 
outputs  from  the  active  CPU  by  comparing 
them  to  its  own  internally  generated  signals. 

A set  of  signals  in  the  monitor  C.PU,  set  under 
program  control,  each  of  whicli  invalidates  a 
different  monitor  generated  signal  for  the  pur- 
pose of  verifying  the  operation  of  the  monitor 
CPU, 

Non-destructive  read  out;  contents  of  a mem- 
ory location  are  not  altered  when  that  location 
is  read. 

A memory  whose  contents  are  not  affected  by 
a loss  of  power. 

The  computational  (non-reconfiguration)  mode 
of  the  UFTSC. 

See  Error  Codes 
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Peripheral  Mask 


Program  Flag 


Real  Time  Interrupt  (RTl) 


Reconfiguration  Mode 


Refresh 


Rippler 


Simplex  Mode 


Single  Point  Failure 
Soft  Addresses 


Soft  Address  Mode 


A set  of  signals  in  each  CPU,  set  or  reset 
under  program  control,  each  of  which  inhibits 
a different  I/O  module's  bus  access  requests 
and  interrupts  from  being  detected  by  the  CPU, 

Any  of  the  seven  three-bit  patterns  passed, 
under  program  control,  from  the  active  and 
monitor  CPUs  to  the  CCUs;  used  for  testing 
and  reconfiguration  purposes. 

A signal  generated  by  the  active  Timing  Module 
every  8.8064  milliseconds  in  the  BFTSC; 
causes  an  interrupt  to  the  CPU  and  begins  a 
serial  bus  frame  in  the  SIU. 

Mode  entered  by  the  BFTSC  following  a fault; 
the  normal  mode  is  reentered  only  after  the 
fault  has  been  isolated  and  the  faulty  element 
replaced. 

The  replacement  of  the  contents  of  each  loca- 
tion within  one  Memory  Module  with  the  cor- 
rected contents  of  that  location  in  a different 
Memory  Module  (cross  refresh)  or  with  the 
corrected  contents  of  that  location  in  the  same 
Memory  Module  (self  refresh). 

Subelement  switching  device  used  in  the  Mem- 
ory Modules  (bit  rippler)  and  at  the  address  and 
data  bus  interfaces  (byte  rippler). 

Mode  entered  only  on  external  command;  when 
the  BFTSC  is  in  this  mode,  all  Category  II 
faults  are  ignored. 

A functional  system  failure  caused  by  a single 
open  or  short  circuit. 

Those  addresses  assigned  under  program  con- 
trol to  the  modules  in  the  BFTSC  and  to  which 
those  modules  respond  in  the  soft  address  mode. 

One  of  two  addressing  modes  in  the  BFTSC; 
used  for  normal  fetch  and  store  operations. 
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Spare  Module  Redundancy 


Subelement  Redundancy 


Syndrome 


Test  Zeros  (Ones) 


Redundancy  at  the  module  level;  an  entire 
module  can  be  directly  replaced  by  a spare. 

Redundancy  at  the  subelement  level;  an  ele- 
ment can  be  divided  into  several  identical  sub- 
elen^ents  and  failed  svibelements  are  replaced 
by  spare  subelements. 

The  EXCLUSIVE  OR  of  the  error  code  stored 
with  the  data  word  in  memory  and  the  error 
code  computed  for  that  word;  points  to  the 
failed  bit  for  single  bit  failures. 

A function  of  each  Memory  Module;  when  in 
the  test  zeros  (ones)  mode,  a Memory  Module 
stores  all  zeros  (ones)  into  any  location  writ- 
ten to  and  sets  a status  bit  for  every  one  (zero) 
in  any  location  read. 


Triple-Modular  Redundancy 
(TMR) 


Watchdog  Timer 


Word  Sync 


W rite  Protect 


Redundancy  technique  in  which  three  identical, 
independent  elements  perform  the  same  tasks 
simultaneously  and  whose  outputs  are  sub- 
jected to  a majority  vote. 

Any  of  the  several  timers  in  the  BFTSC  used 
to  monitor  the  elapsed  time  between  two  related 
events  (e.  g.  , the  initiation  and  the  completion 
of  a bus  transfer)  and  to  generate  an  interrupt 
or  a fault  indication  should  this  time  exceed  a 
specified  limit. 

One  of  four  patterns  of  pulses  transmitted  on 
the  serial  data  bus.  It  consists  of  three  nega- 
tive pulses  followed  by  three  positive  pulses 
and  precedes  each  word  except  the  first  word 
in  every  frame. 

A function  of  each  memory  module;  any  1024 
word  subblock  can  be  directed,  under  program 
control,  to  ignore  any  attempt  to  store  into  it 
and  to  indicate  any  such  attempt  in  the  Memory 
Module's  fault  status  register. 


